missing Folder, viewable in command prompt window

[Albatross63]

Hi Gang,
Last night one of my folders went missing in action.
I am using Windows XP Pro with SP2 and all the latest updates

E:recent downloads is where I save all my files & drivers etc.
place to store them before installing things.
I noticed the problem when I tried to save a file there.. that th
folder didn't appear to be there... but the disk didn't seem to hav
enough disk space free to have accidentally deleted it.
I ran scan disk & didn't find any problems, neither did norto
disk doctor

I shrugged my shoulders & thought 'oh well' and attempted t
recreate the folder. Windows came back with a message 'a folder wit
the same name already exists'.. which stumped me!

I try & create folder with a similar name (e:/recent) and it tell
me that exists too.

I think ahh.. 8.3 file name (recent downloads & recent would b
the same in dos) and go & check the directory of my E drive i
the command prompt.. and sure enough the missing folder is there..!

But it's not visible in windows Explorer, or in My computer

How can I recover the folder/name so windows can see it in norma
folder views?

Thanks in advance !

Ri

 

[Pegasus \(MVP\)]

Hi Gang,
Last night one of my folders went missing in action.
I am using Windows XP Pro with SP2 and all the latest updates

E:recent downloads is where I save all my files & drivers etc. a
place to store them before installing things.
I noticed the problem when I tried to save a file there.. that the
folder didn't appear to be there... but the disk didn't seem to have
enough disk space free to have accidentally deleted it.
I ran scan disk & didn't find any problems, neither did norton
disk doctor

I shrugged my shoulders & thought 'oh well' and attempted to
recreate the folder. Windows came back with a message 'a folder with
the same name already exists'.. which stumped me!

I try & create folder with a similar name (e:/recent) and it tells
me that exists too.

I think ahh.. 8.3 file name (recent downloads & recent would be
the same in dos) and go & check the directory of my E drive in
the command prompt.. and sure enough the missing folder is there..!

But it's not visible in windows Explorer, or in My computer

How can I recover the folder/name so windows can see it in normal
folder views?

Thanks in advance !

Ric

The folder may be hidden. From a Command Prompt, run this
command:

attrib /s /d e:\rec*.*

It will show you the attributes of the invisible folder. You may
also have a problem with your slashes - sometimes you write
E:\Recent, sometimes E:Recent and sometimes E:/Recent.
The first one is correct, the second one ambiguous and the
third one is wrong.

 

[Albatross63]

thanks for the advice

Sorry about my minor typos (slashes the wrong way
that was just me being in a hurry, I definitely type them correctly i
the command prompt window

OK more on the problem
When in the command prompt & I type dir I get a directory listin
but the missing folder & files DON'T show

I type cd e:\recent download
and it does change to the missing directory
I type dir inside the folder & I get a listing of all the file
& folders inside it.. and I can browse up & down thos
directories

does this shed any clues

The attribs suggestion doens't help as it can't find th
files/directory. :

Cheers
Ri

 

[Pegasus \(MVP\)]

There are a few things in your reply that do not add up.
Please run the following batch file, then post the contents
of c:\test.log and c:\test.err:

@echo off
echo %date% %time:~0,5% > c:\test.log
cd /d e:\
echo attrib /s /d recent *.* 1>>c:\test.log
echo attrib /s /d recent *.* 1>c:\test.err
attrib /s /d recent *.* 1>>c:\test.log 2>>c:\test.err
echo cd /d "e:\recent downloads" 1>>c:\test.log
echo cd /d "e:\recent downloads" 1>>c:\test.err
cd /d "e:\recent downloads" 1>>c:\test.log 2>>c:\test.err
cd 1>>c:\test.log 2>>c:\test.err
echo dir 1>>c:\test.log
echo dir 1>>c:\test.err
dir 1>>c:\test.log 2>>c:\test.err

Please do NOT retype these commands - use cut & paste
to get them verbatim into your batch file!

 

[Albatross63]

Thanks for the quick reply

I had to modify the batch file to replace the emoticon :\ :
and ran it. here are the result

Test. log

Sat 24/12/2005 19:44
attrib /s /d recent *.*
Parameter format not correct
cd /d "e:\recent downloads"
E:\recent download
dir

test.er

attrib /s /d recent *.*
cd /d "e:\recent downloads"
dir

I expected this one to show a directory listing..

yet when I type dir it does (cut & paste from command promp
window belo
*******************************************

C:\>@echo of
echo %date% %time:~0,5% > c:\test.lo
cd /d e:
echo attrib /s /d recent *.* 1>>c:\test.lo
echo attrib /s /d recent *.* 1>c:\test.er
attrib /s /d recent *.* 1>>c:\test.log 2>>c:\test.er
echo cd /d "e:\recent downloads" 1>>c:\test.lo
echo cd /d "e:\recent downloads" 1>>c:\test.er
cd /d "e:\recent downloads" 1>>c:\test.log 2>>c:\test.er
cd 1>>c:\test.log 2>>c:\test.er
echo dir 1>>c:\test.lo
echo dir 1>>c:\test.er
dir 1>>c:\test.log 2>>c:\test.er


e
di
Volume in drive E is Dat
Volume Serial Number is 4430-7FB

Directory of E:\recent download

08/12/2005 08:32 PM <DIR>
08/12/2005 08:32 PM <DIR> .
28/12/2004 08:37 PM <DIR> 31eyeto
28/12/2004 08:36 PM 558,841 31eyetoy.zi
11/04/2005 01:10 AM 341,231 aas_en.ex
13/06/2005 08:42 PM 2,855,080 aawsepersonal.ex
14/08/2005 01:57 PM 1,471,985 ab-setup.ex
18/10/2005 12:59 PM 3,331,575 absetup.ex
07/11/2004 09:13 PM 16,706,160 AdbeRdr60_enu_full.ex
11/04/2005 06:11 PM 4,232,867 ads-swf2videopro.ex
30/03/2005 02:45 PM 1,374,841 afjSetup.ex
30/03/2005 03:28 PM 1,592,109 allsplitter.ex
06/09/2005 06:17 PM <DIR> Astronom
30/03/2005 03:30 PM 3,150,549 avi_mpg_rm_joiner.ex
22/05/2005 06:42 PM 7,294,064 AWC-PYS.ex
26/02/2005 01:40 PM 3,006,880 BlazeDVDSetup-Standard.ex
03/02/2004 02:59 PM 1,839,860 bsplay100.805.zi
30/03/2005 02:41 PM 2,623,983 bsplayer122.817.ex
04/10/2005 09:53 AM 2,763,198 bsplayer136.825.ex
18/11/2005 07:56 AM 12,234,628 celestia-win32-1.3.2.ex
08/09/2005 06:11 PM 3,397,424 dap75.ex
20/11/2004 11:42 PM 7,741,336 DivX521XP2K.ex
31/10/2005 09:15 AM <DIR> DOS bo
05/12/2004 10:34 PM <DIR> Evolution Keyboar
24/11/2004 02:39 PM 2,252,305 ffdshow-20041012-sse2.ex
03/08/2005 02:55 PM <DIR> FL
02/04/2005 10:19 AM <DIR> Font
25/04/2005 09:19 PM <DIR> Game
24/07/2005 10:53 AM 10,844,936 GoogleEarth.ex
20/12/2004 11:44 PM 3,999,760 iaplayer_2.05.10.0325.ex
14/09/2005 06:32 PM 4,277,840 icq5_setup.ex
15/09/2005 10:17 PM 4,610,480 icqpro2003b.ex
19/05/2005 02:02 PM 2,564,187 ieSpellSetup211325.ex
08/04/2005 09:29 PM 7,351,496 INSTALL_MSN_MESSENGER_DL.EX
30/03/2005 03:19 PM 1,145,438 instavitricksc.zi
29/04/2005 04:11 PM 1,466,936 jarte_26.ex
04/10/2005 09:58 AM 2,552,802 LimeWireWin-full.ex
09/04/2005 01:51 PM 11,626,016 luxor-setup.ex
30/03/2005 02:53 PM 956,984 MediaFixer.ex
31/10/2005 09:01 AM <DIR> monbas
31/10/2005 08:55 AM 995,430 monbash.zi
16/06/2005 02:34 PM 37,681 MSN_Now_Playing.ex
06/11/2004 09:49 PM 7,674,104 msttsl.ex
21/05/2005 08:53 PM <DIR> New Folde
11/04/2005 01:01 AM 1,603,556 paag12.ex
26/02/2005 01:39 PM 6,350,33
PDVD5_Trial_Deluxe_0603_Enu.ex
19/09/2005 02:01 PM <DIR> Playe
09/10/2005 05:10 PM <DIR> PowerTab
02/02/2005 04:54 PM 10,698,984 PrimoSetup.ex
22/08/2005 07:04 PM 534,104 psa2011_ytb01_DLM_enu_full.ex
07/11/2004 09:09 PM 6,811,656 psa201se_us.ex
29/01/2005 07:06 PM <DIR> Router Firmwar
16/08/2005 07:53 PM <DIR> SEG
01/05/2005 05:38 PM 2,374,785 SetupCloneCD5211.ex
30/03/2005 03:03 PM 10,429,224 setup_mw.ex
24/10/2005 11:17 AM 3,288,858 Shareaza_2.2.0.0.ex
02/12/2005 03:54 PM 8,831,392 SkypeSetup-Beta.exe
02/12/2005 03:53 PM 7,256,768 SkypeSetup.exe
16/06/2005 03:04 PM 1,453,317 SoftAmp_VirtualSound.exe
27/11/2005 10:25 PM <DIR> Sony Hanycam
12/08/2005 04:43 PM <DIR> Sound Plug ins
18/08/2005 08:04 PM 4,030,197 spambully3oe.exe
06/11/2004 10:56 PM 71,275,856 speechsdk51.exe
04/01/2005 02:18 PM 3,109,587 tcmp4.exe
09/09/2005 12:01 AM 25,423 tetka.swf
14/09/2005 02:14 PM 2,781,555 TextAloud.exe
02/10/2005 08:18 PM 2,708,424 ToolbarSetup.exe
05/12/2004 10:12 PM <DIR> usbdriverspc
05/12/2004 10:12 PM 214,307 usbdriverspc.zip
26/07/2005 11:21 PM <DIR> Video Driver
09/11/2004 07:33 PM 2,166,364 vienna23.zip
13/08/2005 12:40 AM 2,641,560 WinAlchemy_setup.exe
25/02/2005 01:03 PM 4,653,416
winamp508e_full_emusic-7plus.exe
04/06/2005 02:47 PM 4,637,842
winamp508e_full_emusic-7plus.zip
26/10/2005 12:08 PM 6,077,712
winamp511_full_emusic-7plus.exe
13/06/2005 01:00 PM <DIR> windowsxpactivatekeygen
13/06/2005 01:00 PM 181,942 windowsxpactivatekeygen.zip
13/06/2005 12:55 PM <DIR> windowsxpcdkeychanger
13/06/2005 12:55 PM 53,643 windowsxpcdkeychanger.zip
21/10/2005 03:12 AM <DIR> Yahoo Games
14/11/2004 10:24 AM <DIR> ?yDTM?zSteinberg Cubase
SX v2.0
09/11/2004 06:55 PM 102,386,545 ?yDTM?zSteinberg Cubase SX
v2.0.rar
59 File(s) 405,450,355 bytes
23 Dir(s) 6,672,629,760 bytes free

*************************************************************
End copy & paste

I'm still not sure what is happening, but am begining to suspect a
rootkit hack of some sort
I've tired to the same name directory on my D drive and it also
disappears, with the same hidden type features.. same for a directory
'recent'. This is really really weird

Cheers,
Ric

 

[Pegasus \(MVP\)]

Thanks for the quick reply.

I had to modify the batch file to replace the emoticon :\ : \
and ran it. here are the results

Test. log

Sat 24/12/2005 19:44
attrib /s /d recent *.*
Parameter format not correct -
cd /d "e:\recent downloads"
E:\recent downloads
dir

test.err

attrib /s /d recent *.*
cd /d "e:\recent downloads"
dir

I expected this one to show a directory listing..?

yet when I type dir it does (cut & paste from command prompt
window below
********************************************

C:\>@echo off
echo %date% %time:~0,5% > c:\test.log
cd /d e:\
echo attrib /s /d recent *.* 1>>c:\test.log
echo attrib /s /d recent *.* 1>c:\test.err
attrib /s /d recent *.* 1>>c:\test.log 2>>c:\test.err
echo cd /d "e:\recent downloads" 1>>c:\test.log
echo cd /d "e:\recent downloads" 1>>c:\test.err
cd /d "e:\recent downloads" 1>>c:\test.log 2>>c:\test.err
cd 1>>c:\test.log 2>>c:\test.err
echo dir 1>>c:\test.log
echo dir 1>>c:\test.err
dir 1>>c:\test.log 2>>c:\test.err



e:
dir
Volume in drive E is Data
Volume Serial Number is 4430-7FBB

Directory of E:\recent downloads

08/12/2005 08:32 PM <DIR> .
08/12/2005 08:32 PM <DIR> ..
28/12/2004 08:37 PM <DIR> 31eyetoy
28/12/2004 08:36 PM 558,841 31eyetoy.zip
11/04/2005 01:10 AM 341,231 aas_en.exe
13/06/2005 08:42 PM 2,855,080 aawsepersonal.exe
14/08/2005 01:57 PM 1,471,985 ab-setup.exe
18/10/2005 12:59 PM 3,331,575 absetup.exe
07/11/2004 09:13 PM 16,706,160 AdbeRdr60_enu_full.exe
11/04/2005 06:11 PM 4,232,867 ads-swf2videopro.exe
30/03/2005 02:45 PM 1,374,841 afjSetup.exe
30/03/2005 03:28 PM 1,592,109 allsplitter.exe
06/09/2005 06:17 PM <DIR> Astronomy
30/03/2005 03:30 PM 3,150,549 avi_mpg_rm_joiner.exe
22/05/2005 06:42 PM 7,294,064 AWC-PYS.exe
26/02/2005 01:40 PM 3,006,880 BlazeDVDSetup-Standard.exe
03/02/2004 02:59 PM 1,839,860 bsplay100.805.zip
30/03/2005 02:41 PM 2,623,983 bsplayer122.817.exe
04/10/2005 09:53 AM 2,763,198 bsplayer136.825.exe
18/11/2005 07:56 AM 12,234,628 celestia-win32-1.3.2.exe
08/09/2005 06:11 PM 3,397,424 dap75.exe
20/11/2004 11:42 PM 7,741,336 DivX521XP2K.exe
31/10/2005 09:15 AM <DIR> DOS box
05/12/2004 10:34 PM <DIR> Evolution Keyboard
24/11/2004 02:39 PM 2,252,305 ffdshow-20041012-sse2.exe
03/08/2005 02:55 PM <DIR> FL5
02/04/2005 10:19 AM <DIR> Fonts
25/04/2005 09:19 PM <DIR> Games
24/07/2005 10:53 AM 10,844,936 GoogleEarth.exe
20/12/2004 11:44 PM 3,999,760 iaplayer_2.05.10.0325.exe
14/09/2005 06:32 PM 4,277,840 icq5_setup.exe
15/09/2005 10:17 PM 4,610,480 icqpro2003b.exe
19/05/2005 02:02 PM 2,564,187 ieSpellSetup211325.exe
08/04/2005 09:29 PM 7,351,496 INSTALL_MSN_MESSENGER_DL.EXE
30/03/2005 03:19 PM 1,145,438 instavitricksc.zip
29/04/2005 04:11 PM 1,466,936 jarte_26.exe
04/10/2005 09:58 AM 2,552,802 LimeWireWin-full.exe
09/04/2005 01:51 PM 11,626,016 luxor-setup.exe
30/03/2005 02:53 PM 956,984 MediaFixer.exe
31/10/2005 09:01 AM <DIR> monbash
31/10/2005 08:55 AM 995,430 monbash.zip
16/06/2005 02:34 PM 37,681 MSN_Now_Playing.exe
06/11/2004 09:49 PM 7,674,104 msttsl.exe
21/05/2005 08:53 PM <DIR> New Folder
11/04/2005 01:01 AM 1,603,556 paag12.exe
26/02/2005 01:39 PM 6,350,332
PDVD5_Trial_Deluxe_0603_Enu.exe
19/09/2005 02:01 PM <DIR> Player
09/10/2005 05:10 PM <DIR> PowerTabs
02/02/2005 04:54 PM 10,698,984 PrimoSetup.exe
22/08/2005 07:04 PM 534,104 psa2011_ytb01_DLM_enu_full.exe
07/11/2004 09:09 PM 6,811,656 psa201se_us.exe
29/01/2005 07:06 PM <DIR> Router Firmware
16/08/2005 07:53 PM <DIR> SEGA
01/05/2005 05:38 PM 2,374,785 SetupCloneCD5211.exe
30/03/2005 03:03 PM 10,429,224 setup_mw.exe
24/10/2005 11:17 AM 3,288,858 Shareaza_2.2.0.0.exe
02/12/2005 03:54 PM 8,831,392 SkypeSetup-Beta.exe
02/12/2005 03:53 PM 7,256,768 SkypeSetup.exe
16/06/2005 03:04 PM 1,453,317 SoftAmp_VirtualSound.exe
27/11/2005 10:25 PM <DIR> Sony Hanycam
12/08/2005 04:43 PM <DIR> Sound Plug ins
18/08/2005 08:04 PM 4,030,197 spambully3oe.exe
06/11/2004 10:56 PM 71,275,856 speechsdk51.exe
04/01/2005 02:18 PM 3,109,587 tcmp4.exe
09/09/2005 12:01 AM 25,423 tetka.swf
14/09/2005 02:14 PM 2,781,555 TextAloud.exe
02/10/2005 08:18 PM 2,708,424 ToolbarSetup.exe
05/12/2004 10:12 PM <DIR> usbdriverspc
05/12/2004 10:12 PM 214,307 usbdriverspc.zip
26/07/2005 11:21 PM <DIR> Video Driver
09/11/2004 07:33 PM 2,166,364 vienna23.zip
13/08/2005 12:40 AM 2,641,560 WinAlchemy_setup.exe
25/02/2005 01:03 PM 4,653,416
winamp508e_full_emusic-7plus.exe
04/06/2005 02:47 PM 4,637,842
winamp508e_full_emusic-7plus.zip
26/10/2005 12:08 PM 6,077,712
winamp511_full_emusic-7plus.exe
13/06/2005 01:00 PM <DIR> windowsxpactivatekeygen
13/06/2005 01:00 PM 181,942 windowsxpactivatekeygen.zip
13/06/2005 12:55 PM <DIR> windowsxpcdkeychanger
13/06/2005 12:55 PM 53,643 windowsxpcdkeychanger.zip
21/10/2005 03:12 AM <DIR> Yahoo Games
14/11/2004 10:24 AM <DIR> ?yDTM?zSteinberg Cubase
SX v2.0
09/11/2004 06:55 PM 102,386,545 ?yDTM?zSteinberg Cubase SX
v2.0.rar
59 File(s) 405,450,355 bytes
23 Dir(s) 6,672,629,760 bytes free

*************************************************************
End copy & paste

I'm still not sure what is happening, but am begining to suspect a
rootkit hack of some sort
I've tired to the same name directory on my D drive and it also
disappears, with the same hidden type features.. same for a directory
'recent'. This is really really weird

Cheers,
Ric

My turn to insert a typographical error, or, in this case,
a space where none should be. Here is the revised version
of the batch file:

@echo off
echo %date% %time:~0,5% > c:\test.log
cd /d e:\
echo attrib /s /d recent*.* 1>>c:\test.log
echo attrib /s /d recent*.* 1>c:\test.err
attrib /s /d recent*.* 1>>c:\test.log 2>>c:\test.err
echo cd /d "e:\recent downloads" 1>>c:\test.log
echo cd /d "e:\recent downloads" 1>>c:\test.err
cd /d "e:\recent downloads" 1>>c:\test.log 2>>c:\test.err
cd 1>>c:\test.log 2>>c:\test.err
echo chkdsk e: /f 1>> c:\test.log
echo chkdsk e: /f 2>> c:\test.err
echo Y| chkdsk e: 1>>c:\test.log 2>>c:\test.err
echo dir 1>>c:\test.log
echo dir 1>>c:\test.err
dir 1>>c:\test.log 2>>c:\test.err

Regardless of this, the last command is supposed to
show a directory listing. The file you posted shows
nothing at all, not even the disk volume information.
Did you chop it off?

 

[Albatross63]

HI & Merry Christmas
No I didn't chop anything off. All the directory listing is show
later on.. the log files didn't show the directory listing fo
unknown reasons

I am seriously suspecting that I have an unknown rootkit virus
It appears to hide all folders that start with "'recent", on al
drives
Each time I create one it disappears, but other names are fine

I can navigate to within the hidden folders if there are files there
and I have a shortcut pointing there ( find target does it

Recent documents is missing inside of Office, as is Recent files i
Windows. Something seriouslty dislikes the word Recent :

I'll keep hunting the net & hope to turn up a solution
Cheers
Ri

 

[Pegasus \(MVP\)]

HI & Merry Christmas.
No I didn't chop anything off. All the directory listing is shown
later on.. the log files didn't show the directory listing for
unknown reasons.

I am seriously suspecting that I have an unknown rootkit virus.
It appears to hide all folders that start with "'recent", on all
drives.
Each time I create one it disappears, but other names are fine.

I can navigate to within the hidden folders if there are files there,
and I have a shortcut pointing there ( find target does it)

Recent documents is missing inside of Office, as is Recent files in
Windows. Something seriouslty dislikes the word Recent

I'll keep hunting the net & hope to turn up a solution
Cheers,
Ric

Boot up in Safe Mode and see if the problem still occurs.
You should also run msconfig.exe and examine the list of
your startup commands.