file eating monster: virus, XP or hard drive

[justravis]

Something is eating away at my files on my new Maxtor 160gb in this particular folder.

Subfolders in Undecoded Folder:
art
ebook
home_video
jokes
movies
mainstream
various_clips
web_content

Subfolders in Various Clips:
Commercials
Jackass
Punkd
Sports

First, all of the folders in Various_Clips disappeard. The folder only contained 2 files, I never saw before, that had names containing special symbols. They were 1.8 & 3.2 gb. I assume those 2 files were a conglomeration of the folders that used to be in Various Clips.

The next day, 3 of the subfolders in Undecoded, including Various_Clips, were converted to 32k files with the same name. They have no file extension. Opening them in notepad only reveals garbage.

Free Space has not changed, so I assume my files are still there.

Now here have been my actions:
1. Norton Virus found and deleted W32.HLLW.Winur.B
http://securityresponse.symantec.com...w.winur.b.html
2. Defraged hard drive using XP, which according to the graph, was necessary.
3. Norton virus no longer found viruses.
4. Norton Disk Doctor diagnosed and made repairs.

When I booted into WinXP after repairs, another folder in Undecoded was converted into a 32k file, so it seems as though the problem persists.

Norton System Info sees a Found.001 folder in the root of the drive. It has many File.00#.chk files in it.

ANY IDEAS WOULD BE GREATLY APPRECIATED???????

[Trickle]

Nuke it from orbit... only way to be sure.

Ok, rather than imidiately format c: I would perhaps trust norton a little more if it rekons there are no virus there - but its been known in the past to either be wrong or virus 'hide' from it.

Perhaps try an onlie free virus scan?
http://housecall.trendmicro.com/

>Screencap of Undecoded folder is attached.

What do you mean by this?

[Stewart]

I think it means he's attached a piccy of the problem. Don't think he has though.

[chrisf6969]

You may have some trojan that is connecting and downloading new variants of the virus which may be undetectable. Download a firewall (like ZoneAlarm) and moniter what is trying to connect to the internet.

But the best / sure way to solve the problem is to format C:/ and start fresh. And stop trying to get free webcam porn access! B/c thats probably where you got it... or downloading warez/hacking tools!

[chrisf6969]

BTW, you dont have some TV tuner card / TIVO like device that you are recording shows with, do you? Because video eats up space. (*** total noob alert ***)

Punk'd, Jackass, etc... (MTV shows)

[justravis]

r u pointing to the fact that video files often take a lot of space? or r u implying that they somehow grow (or eat away) at free space? hmmm..that does not seem to be the issue thus far.

My latest step, as reccomended, was to run a web anti-virus @ http://housecall.trendmicro.com/.

It found and cleaned a PE_HANTANER.A virus ( http://www.trendmicro.com/vinfo/vir...e=PE_HANTANER.A ) from the D:\System Volume Information\_restore(6FC1419A-6CD4-469A-857A-95035305CC02)\RP34\A0005063.exe

I'm new to WinXP, so I dont know if that path has any significance. Just trying to give details to help you help me. Thanks for all your reccomendations. Hopefully I can try them all in the next few days and remedy the problem the best I can.

[justravis]

Disabled system restore. Booted into Safe Mode as Admin. Norton did not find anymore viruses.

Actually looked for PowerManager Registry entry before I ran TrendMicro housecall. It wasnt there then and it is not there now.

[Trickle]

Looks all clear. Gona still be some niggling doubt there, but there isnt going to be alot you can do.

Edit: Yikes, i missed the bit where you said trend online found a seccond virus Norton missed! TBH, I'ed be formatting C: around this point but thats up to you

It found it in the system restore point. Sometimes AV programs like you to dissable system restore, reboot, then run them.... but it doesnt really excuse NAV from not finding it.

The other worry is that Trend online found an innocent file and bodged up :/

[4444405]

Remove Norton would be a good start!
And use Kaspersky Anti-Virus -)

[iranu]

I've found http://www.malwarebytes.org/ to be good in the past at finding some annoying little trojan that seems to come back by nefarious means.

[sleepyhead]

...2003 thread ressurection!!!

[iranu]

...2003 thread ressurection!!!

Hehe I didn't even notice. Is that a hexus record? 6 years!

[Thorsson]

Unbelievable!!

And the thread title looked like one of those hoax emails too...

[Warpy1]

Suprised this hasn't already been suggested. Install http://www.safer-networking.org/en/home/index.html update it to the latest definitions, immunize and run a system scan. This will detect any virus, trojan or spyware and remove it. You might need to boot into safe mode and run the scan if it cannot remove some of the found problems!

[Clunk]

[Fraz]

Looks like 4444405 has finally reached 20 posts for his free shipping. An epic finish.