external hard drive file corruption?

briligg · 10 Jul 2011

We have an external hard drive for back ups. Usually it is in storage, or it is connected to my machine via usb. Occasionally my husband connects it to his xp machine to do back ups or copy a file. After he uses it, when i next connect it to my machine, windows asks me if i want to scan and fix the drive, or open it without scanning. I have always said just open it. I thought win xp left some artifacts on the drive maybe.

Now i see some mysterious files have appeared on the drive, and i can't delete them. I tried doing it from the command prompt, but unless i'm doing something wrong, i get the same error i get when i try deleting them from windows explorer - the file names aren't valid.

Is this indeed because of the sharing of the drive across systems? Is it normal for win7 to ask for a scan and fix of a drive after it has been on a win xp system? How do i delete these files? Should i be concerned about a larger issue?

Golden · 10 Jul 2011

Hi,

Those do look odd. Please do the following before you go any further:

Download, install, update and run a FULL scan of all your hard drives and your external USB drives using Malwarebytes. Please post back the log that is created once the scan is finished.

What ant-virus software is currently installed on:

1. Your PC; and
2. Your husbands XP PC?

Regards,
Golden

karlsnooks · 10 Jul 2011

What did MalwareBytes report?

briligg · 11 Jul 2011

Hi - sorry for not getting back earlier. I'm in a Mexican town, we lose our internet connection regularly.
Both of our computers have Avast, the free version. I just let Avast run in the background, i haven't done a scan in quite a while

. Hubby's computer never gets scanned unless i run it for him.

I'll go get malwarebytes now and do that scan.

briligg · 11 Jul 2011

Avast caught ElistarA on hubby's machine, then i ran it again during boot and it caught 3 PUP's and 1 malware, although it didn't specify what - i could check the report to find out.
Avast run during boot didn't find anything on my machine. I also had it check the external drive from within Windows because i didn't know if that was part of the boot scan - nothing. Malwarebytes had previously found 2 old keygens, which i deleted. I'm happier with Avast, i think i'm going to stick with it, so i took Malwarebytes off the machine again.

So i tried running CCleaner. It looked like it was going to take a few hours to wipe the free space on drive F: (the external), so i shut it down and took another look at F: to decide if the free space wipe was a good time investment. The drive no longer lists the mystery files that were causing me concern. I had moved them to a folder of there own in my attempts to delete them, and that folder is now a 32kb file, it's no longer a folder. The first time i tried to delete it, Windows said its recycle bin was corrupted (what recycle bin?) and i terminated the process from task manager when it hung. I just went back and tried to delete it again, this time there was no problem.

So... for the moment everything seems fine... but do i need to worry about this happening again?

karlsnooks · 11 Jul 2011

next time you run CCleaner.

Just use its default settings. Wipe is an unusual situation, and yes, does require much time.

MSE is FREE! Updated very regularly. The same anti-virus that Microsoft uses in Forefront, the enterprise security software.

MSE is the only anti-virus that I will and do install on my own and other computers.

Golden · 12 Jul 2011

Hi,

You need to consider keeping Malwarebytes on your PC, and updating and running it regularly. This is why:

There isn't a single anti-virus software that will cover every possible bit of malicious code, so by having both and doing scans regularly you minimise your exposure to most (but not all) the evil code out there. We refer to this as a layered security approach : its the simplest and easiest way to protect yourself from this stuff. The same needs to go for your husbands PC, since you swap USB storage devices between yours and his PC.

I'm not entirely sure, but Elistara appears to be either:

1. A legitimate Spanish based anti-virus product, or
2. Fakeware anti-virus product

A lot of my google hits produce poorly rated sites, or my Spanish isn't up to scratch. To be on the safe side, I recommend attempting to uninstall this (unless someone else that is familiar with this product can offer better advice), and re-running scans using free Microsoft Stand Alone System Sweeper.

This tutorial by Brink will show you how to burn the download to a DVD, and use the tool to scan your systems:

https://www.sevenforums.com/tutorials...m-sweeper.html

Do this on:

1. Your PC,
2. Your husband's PC
3. Any and all external USB devices.

If it comes up clean, then ensure both your PC's have current and up-to-date anti-virus products (Avast or MSE will be just fine, don't forget Malwarebytes!). Until you do this, you continue to run the risk of cross-infection between your PC's

Post back here if you need more help.

Regards,
Golden

karlsnooks · 12 Jul 2011

Golden,
good advice.

I do recommend putting the System Sweeper on a USB stick because updating of the System Sweeper is much easier when using a USB stick.

since new malware / root kits / viruses are continually appearing, then updating of the System Sweeper before use is rather much a necessity.

Golden · 12 Jul 2011

Excellent advice - thanks Karl

briligg · 12 Jul 2011

Avast removed ElistarA.exe. So my guess is it was fakeware.

I wonder at what point the mystery files on F: disappeared. It wasn't during the virus scans. It was connected to my machine the whole time. I ran CCleaner's file and registry cleaning programs before i got into the free memory wipe thing, and memory wipe ran for a few minutes before i decided to cancel it. I suppose one of those processes got rid of the weird files.

The layered security approach makes a lot of sense. I worry a bit about different antivirus programs interfering with each other or slowing down my machine. I like it that Avast runs in the background, but i don't know that i would want another antivirus running in the background too. Won't they gum each other up and slow everything down? Malwarebytes seems to run only when intentionally opened, so adding it wouldn't seem to be a problem. MSE? I don't know. I'm going to try to find some more info. Normally, Windows products don't play nice with rival products.