Strangeness on fresh install of XP

Brand new install, clean drive, weird behavior.

[MatthewHSE]

I finally broke down and upgraded my trusty Windows 2000 computer to XP Professional on Thursday. Everything went great and the computer is running better than it ever has.

I formatted the entire disk, I'm behind a good firewall (all ports stealth), the Windows firewall is turned on, Windows Defender and Nod32 were some of the first things I installed, and I haven't been browsing yet on this install except to a few of my usual sites. Windows is fully updated, as are the security programs I'm running.

However, there are a couple odd problems that I don't know how to explain.

First Problem:

The first is the most troubling. While defragmenting last night, I saw a file go by in the status bar called "a_taste_of_sicily.mp3". I thought that was odd since I knew I didn't have a file called that, so I ran a search for it on my PC. The search came up with nothing. I even tried searching for only the parts of the file name I was most sure of - still nothing. To all appearances, that file does not exist on my computer, yet I'm sure I saw it go by in the status bar of the defragmenter.

This brought to mind a rootkit or virus, so I ran RootkitRevealer, Nod32 and Windows Defender. None of these found anything wrong. Moreover, I simply don't see how I could possibly have picked up anything in the short time since installing the OS. I've hardly even checked my e-mail. I haven't even installed Java yet. Nothing comes to mind that could have allowed my system to become compromised, and again, the computer is running great.

So as far as this issue is concerned, I have two possibilities:

1. Take the safe but painful route of wiping the drive and starting over, or,
2. Chalk it up to a mistake on my part by mis-reading the file name in the defragmenter status bar, and life goes on.

I'm not totally comfortable with either choice. Other insights would be appreciated.

Second Problem:

The second thing seems more like a bug, really. A quick Google search reveals that other people are having this problem too. If I open Windows Explorer and go to

C:\Windows\assembly

, the right-hand pane shows all the .NET stuff like it should. But, the folder tree in the left-hand pane shows a subdirectory called "Download." Opening that folder it shows as empty except for another "Download" directory, and so it goes, apparently forever.

More info here... [google.com]

Other people have seen this, and I just checked another Windows XP computer and found the same thing. So it's not unique to my install. It seems more like a bug than anything else.

I'd really appreciate any thoughts on either of these issues.

Thanks!

Matthew

[edited by: MatthewHSE at 4:18 pm (utc) on Dec. 9, 2006]

[jdMorgan]

First Problem:
Be sure that you have set the "advanced options" in Search to search within system folders, hidden files and folders, and within subfolders. Otherwise, the results won't show any files in "Windows" and several other folders. This is probably a "demo" sound file for some application -- I see japanese-language references to Adobe Photoshop Elements when searching on this filename.

Second Problem:
Have you tried renaming or deleting the "Download" subdirectory? If you don't use .NET, then go to Add/Remove programs and uninstall it -- That ought to nuke that subdirectory.

Jim

[MatthewHSE]

#1: Thanks! I was searching system folders, but I neglected to check the box for hidden folders. The file showed up in my PS Elements data directory. That's a relief. I figured it had to be a demo file if it was legitimate, but the fact that I couldn't find it at first was disturbing.

#2: I tried to delete the Download directory, but when right-clicking it the only option I get is "Expand" or "Collapse" instead of the usual right-click context menu. I checked out C:\Windows\assembly from the command prompt and it looked entirely different than it does in Explorer. No files at all, and the following list of directories:

GAC
NativeImages1_v1.1.4322
temp
tmp

Poking around Google indicates that one should expect the /Windows/assembly directory to look different through the CLI than Windows Explorer, so I'm not too concerned about this one. Eventually I'll be able to put it out of my mind! ;) Unfortunately, ditching the .NET framework isn't possible since it's required by two programs that I *need* for work.

Thanks again for your help. I really appreciate it.

[jdMorgan]

If you are using .NET, you might consider uninstalling and then re-installing the framework.

But this sounds like some sort of filesystem error, where the pointer for the subdirectory list in the /downloads directory points to itself. So maybe you should run ScanDisk to see if it can repair the problem. This utility is a bit hard to find: Right-click on the drive icon in "My Computer", select "Properties", select "Tools", select "Error Checking - Check Now". ScanDisk will run during your next re-boot. It can take quite a long time on a large disk -- several hours for a 240 Gb drive, so maybe do this overnight.

I'm wondering why this should be necessary on a clean install, and the only thing I can think of is either an obscure installer error or a physical disk error. So consider why you decided to do the clean re-install in the first place; If it was because the system was acting strange despite the fact that you know it was clean of malware, then perhaps that disk is slowly degrading... Not meaning to sound scary, but it's the only explanation I can come up with at the moment.

Jim

[MatthewHSE]

I reformatted just because I was upgrading the OS and wanted to start clean. The disk is relatively new and I haven't noticed any problems. However, it's worth running the disk scan tonight to see if it turns anything up. Otherwise, I'll try uninstalling/reinstalling the framework to see if that solves anything.

[kaled]

It could be a formatting error, but a disk error is very unlikely. There's no need to do a surfce scan immediately. HOWEVER, it sounds as though the directory in question recursively links to itself. In this case, scandisk may itself end up in a recursive loop and crash.

You could copy a small file into the outermost download directory and see if it magically appears in all (or perhaps every other) nested directory of the same name. BUT try scandisk first.

Kaled.

[MatthewHSE]

Thanks for the ideas kaled. Unfortunately I can't even copy a file into the Download directory. Windows Explorer won't let me drop a file in it, and the Download folder doesn't even show up from the Save As dialog. Very weird; it's almost like Download is a mirage that only appears in Explorer.

Does anybody else see this bizarre behavior with the .NET Framework v. 1.1?

[kaled]

You'll need to investigate from the command-line. Bear in mind that hidden and system files, by default, are not displayed by the dir command. Also bear in mind that special behaviour can be triggered by a hidden file called desktop.ini.

At the command line, type help for a list of commands and help dir for help on the dir command, etc.

<added>
I just checked my own system. I do not see a recursion problem but assembly does have a desktop.ini file and it does display more entries in Explorer than are physically present in the disk directory. There is no physical directory called download!
</added>

Kaled.

[mattur]

I see the same thing on two of my .Net 1.1 XP's. It's actually a special .NET thingummybob rather than a "real" folder, and the bug seems to be with the way it is displayed through Explorer, rather than any underlying filesystem problem. I'd just ignore it.