up vote 2 down vote favorite
share [g+] share [fb]

I just plugged in a brand new micro SDHC card; when I brought up Explorer there was a flash of a filename, and then nothing. The card shows as empty, but when I look at Properties it says there's 32K used. Going to a DOS prompt and using DIR shows nothing. Going to Cygwin and doing ls -la shows only . and .., but it also says there's 4 files in the directory.

I've configured Explorer to "show hidden files, folders, and drives" and unchecked "Hide protected operating system files".

It appears there's 2 super-hidden files. Any idea what they are or how to list them?

link|improve this question
54% accept rate
1  
Boot from a linux Live CD, see if they are hidden now. – Moab Aug 17 '11 at 3:25
feedback

1 Answer

up vote 1 down vote

Try dir /a. It should show all files, even if they have the hidden attribute.

If they're still not showing, the first thing that comes to mind is that the card may have installed a rootkit that is hiding its own files. Do you have autorun enabled? The fact that the number of files reported and the actual list of files doesn't match up is very suspicious to me. dir should tell you the number of (non ./..) files in the directory being displayed in the summary

Try scanning with RootkitRevealer. If the files are only showing up in there you have a problem.

link|improve this answer
Thanks for the answer. I think I tried dir /a originally but forgot to include that in the question; I did it again just to be sure, and didn't get anything. I tried RootkitRevealer as well, and got a little scared when it failed to run; then I saw that it was only XP/2003 and I'm running 64-bit Windows 7. – Mark Ransom Aug 17 '11 at 17:03
dir/a is still saying that there are more files than are displayed? If so, I think something is tampering with your results. You could try browsing the modules loaded in the cmd.exe process. It's simple program and doesn't have much loaded. With signature validation, the only non Microsoft entries should be the NLS (locale) files. – Chris Smith Aug 17 '11 at 17:26
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.