folder name changes erratically

[alberteinstein]

Hi!

i hav a PIII win98 64 MB RAM 20 GB hard-disk.


I had windows installed in c:\windows and win98 was functioning properly for about 2 years.
Later , many of the windows files were found to be corrupted and system wouldnt boot.
so i installed windows in f:\ drive , when just after a few weeks the windows folderand some other folder's were found to be corrupted . ( the folder names change peculiarly --
eg: history folder changes name to hi@tory , 'used file' to 'uped file ' , "program " to" pro__" etc.filename too changes similarly... ).


i ran norton antivirus 2002 with updated virus list , yet it found no virus.

i formatted c: drive and reinstalled windows98 - within a few days , the comp reported
at star up that " win.com file missing , cant run windows " error. i found that win.com has been
changed to won.com , and scandisk reported that certain folders were damaged , and upon fixing the error and opening the folder ( now named dir00001 by scandisk ) , i came to know that
the folder was 'help' folder , as it contained all the windows help files.
this problem happens sometimes only.

i did a online virus scan with panda software. no virus found.

why does the file & folder name keep changing erratically ?


can any one help please.

thanx.

albert.

 

[tahoe2]

could be a trojan. Go to

http://www.safer-networking.org/

and download Spybot.

let us know what happens.

Corie

 

[brendonia]

it might not be a virus or trojan. there are some evil programs that people make and dont show up on anti-virus programs. i suggest you take it to your local service shop and get it checked out.

LET ME NO HOW IT GOES!

 

[alberteinstein]

HI!

I did a scan with spybot & then with adaware .I dont think there is some thing very abnormal from the scan.

My dial-up connxn 2 internet was working properly until recently.
now when i click the auto dialer icon , i get the error :
" cannot load Remote network access library [RASAPI.dll].Foolowing error occured.The system cannot file specified . ".

Upon clicking OK to the message , there is anothermessage " connection manager cannot continue
because dial-up networking was not installed properly.......etc "

Upon clicking the dial up networking folder from my comp, nothing opens up .
I uninstalled & reinstalled Dial-up networking from add-remove program. no use.
HOwever i searched for RASAPI32.dll , & i did find it in c:\windows\system folder.


some file name & extension were found to be changed changed erraically like win.com to won.t_p
etc.

i think a virus /trojan is playing havoc as u said , but norton cant find any. [ virus defnrotection against 65217 virus].

a note : my mouse pointer sometimes starts moving to the left horizontally , without me actually moving the mouse.

here is the log for spybot :

Alexa Related: What's related link (Replace file, fixed)
C:\WINDOWS\Web\RELATED.HTM

Avenue A, Inc.: Tracking cookie or cookie of tracking site (File, fixed)
C:\WINDOWS\Cookies\asc@atdmt[1].txt

Commission Junction: Tracking cookie or cookie of tracking site (File, fixed)
C:\WINDOWS\Cookies\asc@qksrv[2].txt

DSO Exploit: Data source object exploit (Registry change, fixed)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004=W=3

HitBox: Tracking cookie or cookie of tracking site (File, fixed)
C:\WINDOWS\Cookies\asc@hitbox[1].txt

HitBox: Tracking cookie or cookie of tracking site (File, fixed)
C:\WINDOWS\Cookies\asc@hg1.hitbox[2].txt

Windows Media Player: Client ID (Registry change, fixed)
HKEY_USERS\.DEFAULT\Software\Microsoft\MediaPlayer\Player\Settings\Client ID=


--- Spybot-S&D version: 1.2 ---
2003-03-16 Includes\Temporary.sbi
2003-03-16 Includes\Cookies.sbi
2003-03-16 Includes\Dialer.sbi
2003-03-16 Includes\Hijackers.sbi
2003-03-16 Includes\Keyloggers.sbi
2003-03-16 Includes\Malware.sbi
2003-03-16 Includes\plugin-ignore.ini
2003-03-16 Includes\Security.sbi
2003-03-16 Includes\Spybots.sbi
2003-03-16 Includes\Tracks.uti
2003-03-16 Includes\Trojans.sbi

Now do u think a trojan is present? what could be causing the problem.

Please help.thanx.
albert.

 

[Rob2806]

You could run HijackThis. This gives a complete listing of everything that is being enabled by your computer.

It can be downloaded from:

http://www.tomcoyote.org/

You can then paste the log on this site. It will give information on what may be causing the problem.