Error when opening a folder in XP

[real_ki]

I am running Windows XP Pro.
I have a directory/folder with some .avi files.
Everytime I open that folder in GUI (i.e. via using the explorer or via a File dialog from an application) I get the "Windows Explorer has encountered a problem and needs to close." dialog when opened with explorer or the application terminates when using the file dialog.

I searched around the web and didn't find anything useful... maybe I didn't search the right key word. So, I am here asking if anyone knows what might be going wrong or might suggest some way to debug this problem.

One thing I did notice though is that if I connect to this same folder from another machine via "net use", I do not see the error from the other computer... So something must be wrong with that computer with that folder.

Any help and comments will be appreciated as usual..
Thank you.

[Paul Komski]

Can you copy the contents to another folder and see if the same errors still occur from that folder?

[real_ki]

So I copied everything over to another new directory.
At first it looked like things were all OK.
But this is the pattern of behavior that I am seeing in the new directory.
Opening a folder is OK. But I get the same Explorer error as soon as I select one of the files (just select, not actually play or run).

The original folder that was giving problem still behaves the same...
Though I noticed this which I may not have tried before...
Previously, I've been getting to that folder from GUI (i.e. from My computer and into the driver then into the directory), but when I use the Command Prompt and get to the directory then issue "start ." to open the folder, it stays open w/o error as long as I don't select the file.

Also.. with the new folder that I copied the contents to... When I get there with a File dialog, it doesn't immediately terminate the application.. seems like it takes maybe 10 or so seconds before the application terminates... however, it does terminate as soon as I select a file.

very weird...

[mjc]

Do you have 'show hidden' files set in Explorer's options?

What about the view format for the folder...is it set to show thumbnails?

When was your last AV scan? results?

It is sounding more and more like a malicious file is residing in that directory...

[Paul Komski]

I agree - something screwy going on be it malware or a corrupt file system.

No harm to run chkdsk /F and reboot.

How big actually are the files in question and what file extensions do they have or are you unable to determine that except maybe from a dir command at a command prompt. Also do the files add up to the size of the folder?

[Sylvander]

"It is sounding more and more like a malicious file is residing in that directory..."
And hidden?

In which case, how about using Rootkitty v1.0.9 (http://www.ezpcfix.net/download.aspx?dload/RootKitty.exe) to...
(a) Scan the file system within Windows and save the list of files to C:\Win-Files.txt
Then...
(b) Scan using the same rootkitty.exe [it's portable] using a suitable OS [UBCD4Win, BartPE, Knoppix+WINE] from outside of Windows, and save the list in C:\PE-Files.txt.
Then..
(c) Use either Rootkitty or a file compare program to look for the differences between the two lists of found files in those 2 text files...
The difference would probably be due to files [hidden within Windows] being revealed from outside Windows.
You might look for your folder and study the list of files found inside it.
[It would be interesting to see if Rootkitty can access the folder, inside or outside Windows]
(d) Rootkitty has tick boxes that can be ticked to delete any of the "differences".

I got the link to Rootkitty here. (http://ubcd4win.com/forum/index.php?showtopic=5868)

[real_ki]

mjc, I do have "show hidden files" set in the folder options and I use "List" view and Virus scan didn't find anything.. I used both Symantec Antivirus and AVG Anti-virus (a free version).

Paul, the all files are right around 700MB and they are .avi files (DivX or XDiv). File sizes do add up. I haven't tried chkdsk /f and rebooting yet, but I will give that a shot.

Sylvander, do I need to scan the complete file system including all the drives? Or is the drive containing that folder good enough? Also, wouldn't the command "dir /a" inside that directory basically tell if there's anything hidden in that directory? Or are you also asking me to check others as well like the Temp directory and Temporary Internet Files direcctory?

[mjc]

It doesn't really matter what view you are using, unless you explicitly turn off thumbnail caching XP will still do it...

1. Click on "CONTROL PANEL" from the Start Menu.
2. Click on "FOLDER OPTIONS" in the Control Panel.
3. Click the view tab
4. Finally - tick the "DO NOT CACHE THUMBNAILS" box and then click APPLY.


And then find the thumbs.db in that folder and delete it (don't send it to the recycle bin...right click on it, select Delete and hold down the shift key while hitting enter).

[Sylvander]

1. "do I need to scan the complete file system including all the drives?"
No...
You can scan as little or as much as you like; the default is C:\ but you can change that. [See screenshot]
Seems like a good idea to scan all of C:\ as some point.

2. "wouldn't the command "dir /a" inside that directory basically tell if there's anything hidden in that directory?"
I think not.
The whole reason/purpose for the making of Rootkitty...
Is that malicious programs that are concealing their files from the user within the Windows environment...
Would [only/probably?] be seen from outside the Windows environment.
And that fact is used as a means to identify/display them.

3. "are you also asking me to check others as well like the Temp directory and Temporary Internet Files directory?"
Well, if it were me, I'd want to check everywhere I thought the malicious program might be hiding files; most likely C:
.

[real_ki]

Sorry, I've been pre-occupied with something else and hadn't had much chance to debug this problem.. I did try the chkdsk and that didn't help. Setting "Do not cache thumbnails" does help a bit (I can open the folder from GUI and it stays open w/o the error until I select a file. Using File dialog from an application seems to be all OK). This is good enough (at least for now), but if and when I get to try the Rootkitty, I will post more info. Thank you all!

[IM back!]

how about using a linux live cd to deleat it?