[kunafa]

Hi guys

This is my first post on this forum. I found it while surfing the net. I am already impressed by the amount of information that can be found here.

Well, now to my problem.
I installed Windows XP on my friend's PC. Everything went fine. After that I installed the necessary drivers and other applications including Flyakite OSX 3.5, which turns your Windows into Mac OS X.
Everything seemed OK until I opened My Computer as usual and tried to open drive D: . Surprisingly it didn't open, it rather gave me a dialog box telling me to choose the program I want to open this "file". Strange!!
When I right click on the partition and chose explore or open it open normally. The same happened with all my partitions except the primary partition C:. It's the only one I can open through my computer. When I want to access the other drives I used Windows explorer or simply press the "Folders" button in My Computer. I have also noticed that when I right click on these partitions I get strange signs like 'x@ in the menu that appears.

My guess was it's a virus, so I did a full system scan with Avast antivirus. It did find two trojan horses, I moved them to chest (quarantine). But that's it. And still the same symptoms as before.
Before I forget, there was another strange thing, but that was resolved (I think) when I did the avast system scan. Whenever I select one folder, the surrounding folders are selected, too. It's like I use the Ctrl+A shortcut. But the is gone now (or maybe just hidden??). This sign was accompanied by unresponsive right mouse button action, i.e I couldn't open any file or program at all, I wasn't even able to shut down Windows without using the the task manager and select shut down from there.

I really don't know what that is. It's a virus for sure, but avast didn't detect it. OK I have not updated the virus database (2 months old or more as this is the source file) as his phone line was not working back then. I will manually download the update and install it and re-scan the drives. But I was asking you here, maybe you have seen this "thing" before.

My friend's PC is P4 1.5 GHz, 256 SDR @133MHz, HDD Maxtor 40Gb with 4 partitions, Geforce2 MX 400 32 Mb DDR.
I hope this helps.

Before posting I did a forum search to prevent double posts. I hope I didn't.

Thank you in advance guys.

kunafa

[Elvandil]

My guess is that it is FlyAKite that is causing the problem. Did the problem exist before you installed it?

[kunafa]

Thanks for the quick reply :-)

I don't think it's Flyakite as I have installed it on another PC and on my own laptop, but both work fine. I asked my friend the same question, if he saw this before even without flyakite. He said that he saw it three or four times before his PC raised the white flag and needed a clean install.

[Elvandil]

Originally Posted by kunafa

He said that he saw it three or four times before his PC raised the white flag and needed a clean install.

That sounds more like hardware troubles if it happened before the installation.

Try testing memory and the hard drive.

MemScope (Floppy and CD images.)
Microsoft Memory Test (floppy or CD ISO image)
Memtest86

[kunafa]

Thank you Elvandil.

I did a hard disk check right after I installed Windows. Memory is fine, too. Everything works fine, iTunes, WMplayer and Games. No lags or anything. It's just this annoying problem with the partitions. Today when i checked the virus chest of avast to see how many viruses are in quarantine I noticed that there were three trojans all the same located in D, E and F partitions, the exact three partitons that show this strange behaviour. So I deleted them, but still no luck :-(
What makes me think that it's not a hardware problem or a specific software problem is that drive C open just fine, so why the others not? And remember when I told you about the Ctrl+A problem I had when I select any file or folder? Well, it's back (Arnold Schwarzenegger). I will download today the virus database for avast and do another scan. If that doesn't work I will format all three drives to completely eradicate this stupid annoying trojan.

Thank you again.

See you

[Elvandil]

Yes, getting rid of the infection may be easy enough, but you still may not be able to track down the changes it leaves behind.

Good luck.

[kunafa]

What changes? You mean to the hard disk or Windows itself?

I thought of installing windows again, but it's such a pain, takes too much when you need to install all the software again. Man I hate that.
But if this is the only way to completely eradicate this trojan, I find no choice but doing it, of course after the avast scan fails.

Thanks

Will keep you updated.

[Elvandil]

You could first try the repair installation over the top of the current one.

Repair Installation Instructions
or
How To Run A Repair Install
(How to Repair Windows XP by Installing Over top of Existing Setup)

All you do is boot from the CD. When it asks if you want to repair and to press "R", don't. Continue with the installation just like you were installing for the first time.

You will then get a license agreement and it will ask you to press F8 to agree. Right after that screen, you will see a list of Windows installations that setup found. It will ask if you want to repair it. Read the directions on that page!!!

Then, you will actually press "R" this time and XP will re-install.

When done, you will be back to your familiar desktop with everything looking just like it did before. But all your Windows Updates are gone and you will need to get those again.

If you have any problems booting from CD, set the CD to boot earlier than the hard drive in BIOS setup, or come back for more help. If you don't get the "Repair" optin to press the second "R", then your registry is too damaged for a repair and you need to restore an earlier copy of the registry.

[kunafa]

Thank you very much for your help and instructions.

I fixed the problem. Here's what I did.
I booted the pc using partition magic boot CD. I than deleted the three drives D,E,F (aka the extended partition). Then I created them again. When I booted back into Windows everything was alright. Windows recognized the drives again and I was able to access the three drives using My Computer.
After that I instantly installed avast and did a full system scan again to be sure.

Before all that I tried to fix the problem without deleting the partitions through virus database update and re-scanning all drives. One trojan on D was found. But even after that it was not accessible through My Computer. After that I was so angry that I decided to delete the partitions and see what happens. Luckily they didn't contain important data, just songs and videos that can be recovered.
Though it was a radical move, it worked.

Again I thank you for your help Elvandil.

kunafa

[Elvandil]

Good work.

You can mark your own threads "solved" using the Thread Tools above.

[B3master]

This sounds alot like a virus I caught couple months ago December 07. Its a virus that CREATES an autorun file on the partitions that it resides in with an autorun command to launch itself and hence move to other partitions. I dont know what more it does I think AVG didnt let it execute properly even though it was still on the drives and i kept trying to double click the drive to access them.

Simply after scanning and quarantying I had that constant pesky problem of not being able to double click a partition and upon right click the "oped" and "explore" are gone and instead i have weird signs and chinese characters.

Solution was after thorough scan and removale of the *.exe virus simply DELETE the autorun file on root in each of these partitions and reboot. you will get your double click, "open", and "explore" BACK.