8

Specification: Windows 10 with Norton Antivirus and CCleaner.

When I try to create a folder named "a", it disappear from the explorer just after the action. I noticed the explorer says a message "working on this", it take some time and then the message disappear too.

enter image description here

Now it seems that the folder doesn't exist. But when I try to create another folder with the same name I got the error 0x80070103.

When I try to create a folder with the name "b". Something different happens. The folder is changed to an unamed file with no extension just like the following image:

enter image description here

In safe mode I can do everything; also I can see the folder just like I created. Back in normal mode, I tried to use Windows Process Explorer but I can see which process is locking/using the folder. In safe mode, I can delete, create new files inside the folder "a" or "b" but in normal mode, I can't access them. No way.

I full scan with Norton Antivirus: no virus. I bought spyhunter: it isn't related. CCleaner Pro: it isn't related. I tried Scan disk, windows tool for correcting errors... no hell. Stopped Norton Antivirus: same situation.

It seems some software/virus is bug me down. I need folder like this because tools like SVN and Android Studio has idiosyncrasies about file and folder structure that just use this names.

Please help, can't just format everything and start again..

EDIT 1: A Test from DOS

enter image description here

The folder "b" disappeared and the folder "a" look like a file with no name and extension.

By doing a DOS "dir" command, I have the following result:

enter image description here

In this pic, "Pârametro Incorreto" means "Incorrect Parameter". Arquivo means "File". Past means "Folder". It says 1 file and 2 folders were found but there is tree folders inside.

  • 2
    This sounds similar to some rootkit file cloaking mechanisms, but there isn't really enough information to work with, and its unlikely that a rootkit would behave differently in Safemode, and matching a pattern like a, b for hiding files would be way to simple to remain undetected. usually its like $SYS$... or some such. – Frank Thomas Aug 18 '16 at 15:08
  • 1
    If you use cmd does mkdir b work? What's the outcome of dir /a (list all files&folders)? – RJFalconer Aug 18 '16 at 15:11
  • 2
    Looks like a trace of a MS-DOS compatibility feature enabled in standard mode IMHO (a and b being both floppy drives). If this is the case, then the same kind of weirdness may occur with some other names like COM1 to COM4, LPT1 to LPT4 and CON. – A. Loiseau Aug 18 '16 at 20:07
  • 2
    After a fast check, floppy drive letters are not officials MS/MSDOS reserved names if docs are accurate (support.microsoft.com/en-us/kb/74496 and msdn.microsoft.com/en-us/library/windows/desktop/aa365247), but someone else is reporting the same issue with Windows7 on a microsoft.com forum which still lacks any real answer for now (answers.microsoft.com/en-us/windows/forum/windows_7-files/…). – A. Loiseau Aug 18 '16 at 22:38
  • 2
    Just wondering... What kind of drive is that E-drive? Is it a network drive that other machines have access to as well? If you test from safe mode, do you use networking safe mode and do you use the same locations? Is the behaviour the same on other drives/dirs (say you try to create c:\tmp\a or c:\tmp\b or something)? Just brainstorming here, probably not as simple as that but it needs to be excluded that it's like server AV functionality or maybe a virus on another workstation? – SadBunny Aug 20 '16 at 23:39
6

I was trying to stop services in normal mode which didn't run in safe mode, then I have accidentally solved the problem this morning.

Here in Brazil, a lot of users complain about GBPlugin - a technology most bank companies require users to use in order to access their bank account online. This GBPlugin consumes lots of resources and requires a highly skilled approach to be removed from the OS.

I tried to remove it following this post. Somebody named "DigRam" suggested a scan with AdwCleaner which had shown two suspect services:

  1. 412f21e02ea37d13c378594fcbac2bd2
  2. scan

AdwCleaner scan result has no effect on GBPlugin at all but had these two - suspicious. But after the Windows reboot I could finally see, create, change and delete the folders which had been hidden (in normal windows mode).

I can see folder again

I can't determine who was the troublemaker and I really don't care right now. Both were killed and the OS is OK now.

Finally:

  • I couldn't remove GBPlugin yet, but that is another problem with an existing solution.
  • I bought spyHunter which I regret.

Below, is the scanning result

# AdwCleaner v6.000 - Relatório criado 21/08/2016 às 09:08:22
# *Updated on 12/08/2016 by ToolsLib
# Banco de dados : 2016-08-21.1 [Servidor]
# Sistema operacional : Windows 10 Pro  (X64)
# Usuário : eduar - MOBISTATION
# Executando de : C:\Users\eduar\Downloads\adwcleaner_6.000.exe
# Limpar
# Apoio : https://toolslib.net/forum



***** [ Serviços ] *****

[-] Políticas do IE excluídas412f21e02ea37d13c378594fcbac2bd2
[-] Políticas do IE excluídasscan


***** [ Pastas ] *****

[-] RestauradoC:\Users\eduar\AppData\Roaming\ParetoLogic
[-] RestauradoC:\ProgramData\ParetoLogic
[-] RestauradoC:\Program Files (x86)\xtex
[-] RestauradoC:\Users\Public\Documents\dmp
[-] RestauradoC:\Users\eduar\AppData\Local\Geckofx


***** [ Arquivos ] *****



***** [ DLL ] *****



***** [ WMI ] *****



***** [ Atalhos ] *****



***** [ Tarefas agendadas ] *****



***** [ Registro ] *****

[-] Restaurado[x64] HKLM\SOFTWARE\Classes\CLSID\{65416821-217D-44BD-9C61-F53398FB1B46}
[-] Restaurado[x64] HKLM\SOFTWARE\Classes\CLSID\{6DFC0DC7-FDC5-44C2-8B80-5977BA8F8ACC}
[-] Restaurado[x64] HKLM\SOFTWARE\Classes\CLSID\{E5AFF088-92F8-41a9-8CAB-E9CDCCE967AC}
[-] Restaurado[x64] HKLM\SOFTWARE\Classes\CLSID\{4ABDD67C-44E3-42E0-816D-D7F0E54761DF}
[-] Restaurado[x64] HKLM\SOFTWARE\Classes\CLSID\{94915A56-4D71-4F85-B59C-CC040F5AC6F0}
[-] Restaurado[x64] HKLM\SOFTWARE\Classes\Interface\{65416821-217D-44BD-9C61-F53398FB1B46}
[-] Restaurado[x64] HKLM\SOFTWARE\Classes\Interface\{4ABDD67C-44E3-42E0-816D-D7F0E54761DF}
[-] RestauradoHKLM\SOFTWARE\Classes\Interface\{65416821-217D-44BD-9C61-F53398FB1B46}
[-] RestauradoHKLM\SOFTWARE\Classes\Interface\{4ABDD67C-44E3-42E0-816D-D7F0E54761DF}
[-] RestauradoHKLM\SOFTWARE\Classes\TypeLib\{34F4FEAF-4921-4B5D-8BE5-CA384BFFC2CE}
[-] RestauradoHKLM\SOFTWARE\Classes\TypeLib\{39A37965-0A96-43A3-870E-821FE5C84B0B}
[-] Restaurado[x64] HKLM\SOFTWARE\SmartPCFixer
[-] RestauradoHKU\S-1-5-21-3215691145-4218728392-1243681445-1001\Software\IM
[-] RestauradoHKU\S-1-5-21-3215691145-4218728392-1243681445-1001\Software\ParetoLogic
[#] *Key deleted on reboot: HKCU\Software\IM
[#] *Key deleted on reboot: HKCU\Software\ParetoLogic
[-] RestauradoHKLM\SOFTWARE\ParetoLogic
[-] RestauradoHKLM\SOFTWARE\SmartPCFixer


***** [ Navegadores ] *****

[-] [br.ask.com] [Search Provider] Excluídobr.ask.com


*************************

:: Chaves "Tracing" excluídas
:: Configurações Winsock restauradas

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [2494 *Bytes] - [21/08/2016 09:08:22]
C:\AdwCleaner\AdwCleaner[S0].txt - [2676 *Bytes] - [21/08/2016 09:04:40]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [2642 *Bytes] ##########
  • In order to uninstall these annoying and useless bank plugins, I booted into safe mode, disabled their services and initialization entries, uninstalled from control panel and then manually looked for and deleted any forgotten files and registry entries. Will we ever be free from these accursed plugins? – Matheus Moreira Aug 29 '16 at 5:25
  • Your bank requires an almost impossible to remove software? Sounds like a horrible 'security solution' & time to change banks! Also, Norton, really? Why put yourself thru that pain? – RozzA Nov 3 '18 at 0:21

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.