Bizarre Problem - Files Disappearing!

[Hibes]

I have a very strange problem with files disappearing or hiding themselves
in Explorer windows. It only happens with files that start with underscore
"_" so that if I were to rename "test.txt" to "_test.txt" for example, it
would disappear from the explorer screen. However in a DOS prompt window
the file would still be there.

I have Win XP and just upgraded to SP2 to see if that would help. No luck.
Tried scanning for viruses and hijackers using Spybot and Ad-aware, and all
clean. No unusual processes in the Task Manager or system Start Up. My
folder options are set to display hidden files. I'm at a loss. Just a few
days ago these files were working fine.

Any ideas would be greatly appreciated. Thanks.
Hibes

 

[Wesley Vogel]

FP97: Files, Folders Beginning with Underscore Character Disappear
http://support.microsoft.com/default.aspx?scid=kb;en-us;186263

FP98: Files, Folders Beginning with Underscore Character Disappear
http://support.microsoft.com/default.aspx?scid=kb;en-us;194244

FP2000: Files, Folders Beginning w/ Underscore Character Disappear
http://support.microsoft.com/default.aspx?scid=kb;en-us;205662

 

[Hibes]

These articles pertain to FrontPage which I don't have installed on my
system. So I don't think that will help.

Can't seem to find any information about this problem anywhere.

Hibes

 

[cquirke (MVP Win9x)]

On Fri, 10 Dec 2004 18:07:59 -0700, "Wesley Vogel"

FP97: Files, Folders Beginning with Underscore Character Disappear
http://support.microsoft.com/default.aspx?scid=kb;en-us;186263

FP98: Files, Folders Beginning with Underscore Character Disappear
http://support.microsoft.com/default.aspx?scid=kb;en-us;194244

FP2000: Files, Folders Beginning w/ Underscore Character Disappear
http://support.microsoft.com/default.aspx?scid=kb;en-us;205662

All of that applies to Front Page.

The poster was referring to files as listed in Windows Explorer.

Tell me: Do the file names lose the first character, i.e. is it...

ReadMe.txt -> _eadMe.txt

....or...

ReadMe.txt -> _ReadMe.txt

....?

If the first, I'd worry about some hware flakiness nulling out the
first character (Explorer may show odd characters as _ )

Mind you, any file name starting with the null character is itself
ignored as being the end of the directory. So you wouldn't see the
file via any method, if that were the case.

The true horror of setting the first character of a file name to null,
is that when Scandisk or ChkDsk "fixes" the directory, it throws away
*all* subsequent files and subdirs after that point !!



The real

------------ ----- ---- --- -- - - - -

The most accurate diagnostic instrument
in medicine is the Retrospectoscope

 

[Hibes]

Tell me: Do the file names lose the first character, i.e. is it...

ReadMe.txt -> _eadMe.txt

...or...

ReadMe.txt -> _ReadMe.txt

...?

If the first, I'd worry about some hware flakiness nulling out the
first character (Explorer may show odd characters as _ )

No, the files don't lose any characters. They just disappear when renamed
with an underscore as your 2nd example. And all files/folders on my
computer that were already named with an "_" as the first character, have
all vanished from Windows Explorer too. And if I search for them using
Windows Search it won't find them either. Only in a DOS window I can find
them, as I say.

It's driving me a bit nuts...

Hibes

 

[cquirke (MVP Win9x)]

No, the files don't lose any characters. They just disappear when renamed
with an underscore as your 2nd example.

Interesting, in that a straight data corruption iisn't likely to shift
characters in the name without also shifting all the other fields in
the dir entry and thus utterly barfing it up.

The consistency and pattern suggests it's done programatically,
possibly by malware. The same change to the name may also change the
attributes - but you say you are already set to "show all".

I'd go in with DiskEdit in DOS mode and have a hex look at those dir
entries - my hunch is that "_" is not Char(95) as you'd expect.

Is this on MTFS or FATxx?

Only in a DOS window I can find them, as I say.

It's driving me a bit nuts...

I can imagine; sounds well spooky :-(

--------------- ----- ---- --- -- - - -

Tech Support: The guys who follow the
'Parade of New Products' with a shovel.

 

[Hibes]

The consistency and pattern suggests it's done programatically,

possibly by malware.

That's my gut feeling too. I've tried using Ad-aware, Spybot and Mcafee
VirusScan and it found nothing.

Is this on MTFS or FATxx?

NTFS.

Thanks for the suggestions, I'll keep trying or just ignore until I can
catch it with Spyware removal.
Hibes

 

[lazlo]

I'm on Win2K, but have also just recently noticed this problem, as
well. Was not happening a week ago. I routinely name directories with a
beginning underscore so that they sort to the top of directory
listings, so I detected the problem immediately. I've scanned for
viruses and spyware and have turned up nothing. Anyone find out
anything more about a possible cause for this? I believe the only thing
I've installed on the machine recently is a copy of The Sims 2.

 

[Guest]

I too have noticed that my xp sp2 machine is also hiding files beginning with
the underscore character. I have done a full virus scan, ran adaware and
spybot, and still not been able to resolve the problem.
I have noticed that in my Kazaa shared folder there are five or so small
files beginning with an underscore that are invisible as well. These pertain
to be cracks for various software such as doom and nero. What intrigues me is
that
1) I have never downloaded this software before
2) These files reappear after I delete them and then reboot the machine.
This did leave me to believe that a rogue process was running on startup,
but I have not been able to pin point it.
I have also tried creating a new user account but the problem persists

Regards

 

[cquirke (MVP Win9x)]

I'm on Win2K, but have also just recently noticed this problem, as
well. Was not happening a week ago. I routinely name directories with a
beginning underscore so that they sort to the top of directory
listings, so I detected the problem immediately.

I use ! for that, as ! is always ! but _ can be anything Windows
Explorer doesn't want to display as a valid file name character. But
note that ! will usually be botched to _ on CDR file systems.

I believe

.... that's what av and anti-cm scans will verify ;-)

the only thing I've installed on the machine recently is The Sims 2.

One nasty thing that I'd like to personally beat the Sims team over
the head for, is that it dumps a huge chunk of gunk in the "My
Documents" object. No code, so not infectable, but it is VERY
ANNOYING to find the backups of your Office files have bloated up from
50M to 400M because of this.

Worse; you cannot relocate this data, either at installation time or
via Regedit. The dumb app is HARDCODED to look within your data set
for its data, and that blows chunks out both ends.

Oh; and The Sims 2 requires the player to be running with
Administrator rights.

Windows XP is HOW many years old, now? Just when are these idiots
going to write software that works properly in XP?

It's a shame, because as a game, the Sims 2 really rocks!

--------------- ----- ---- --- -- - - -

Tech Support: The guys who follow the
'Parade of New Products' with a shovel.

 

[cquirke (MVP Win9x)]

On Thu, 30 Dec 2004 01:15:02 -0800, "Trueblue"

I too have noticed that my xp sp2 machine is also hiding files beginning with
the underscore character. I have done a full virus scan,

Formal? Or "let's hope the virus writer is too dumb to defend itself
against a scan done from within infected Windows"?

ran adaware and spybot, and still not been able to resolve the problem.

I have noticed that in my Kazaa shared folder there are five or so small
files beginning with an underscore that are invisible as well. These pertain
to be cracks for various software such as doom and nero.

Ahhhh... you most likely have an active malware that's seeding your
Kazaa "shared" in the time-honoured passive trojan tradition of
PKZIP300 and AOL4FREE .

What intrigues me is that
1) I have never downloaded this software before
2) These files reappear after I delete them and then reboot the machine.

Yep. Well, you can guess the rest, by now.

This did leave me to believe that a rogue process was running on startup,
but I have not been able to pin point it.
I have also tried creating a new user account but the problem persists

Formal virus check, buddy!

Now that you mention it, the original poster mentioned installing "a
COPY of The Sims 2". If that means what I think it means, then hullo,
guess where the virus may have come from, duh.

Malware writers often target two types of suckers; those greedy for
warez, and those cruising for porn.

Not only are these folks likely to click first and think later (if at
all... especially if they are "thinking with the wrong head", so to
speak) but they are unlikely to own up to clicking such material in an
office setting, thus delaying forensics.

-------------------- ----- ---- --- -- - - - -

Trsut me, I won't make a mistake!

 

[lazlo]

I figured out that the problem on my system was the Fructa trojan:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.frutca.html

I deleted it by hand -- no virus scanner could detect it because it was
so completely hidden. However, I was able to delete the hidden files
when I viewed my WINNT directory via an FTP app.