Very weird occurance..

Hi,

Your general security approach seems very good and the malware scans come up clean, so it sounds unlikely, but not impossible, to be from some sort of infection. The behavior of automatic open files and folders is still very odd...........something sounds odd about it.

You mentioned a second (your wife's?) laptop? Is it subject to the same level of security as yours? I presume you scanned both laptops? You mentioned "in-transit" : do you ever use the internet from a public domain? Public Wi-Fi hotspot for example? Does her laptop display similar automatic file/folder openiing behaviour?

There is one last thing that I can think of, and that is to burrow a bit deeper. Can you please download and run RunScanner - it will tell you a bit about the services and files on your system, and you may spot something untoward.

When you run it, choose the Beginner Mode and then run it. It will scan your system and then request you to save the results in a text file. When you open that text file, it will look similar to the example from my PC shown below. Note that "unrated items" are not neccessarily bad : the software may just not know how to classify them.

I also would like to ask Jacee and Corinne (our resiendent security experts) to have a look at this issue if they have the time, so I'll send them a message and ask them to visit here and make any other comments or suggestions if they have any.

Regards,
Golden

Hi C32C3

Download SilentRunners http://www.silentrunners.org/Silent%20Runners.zip
1. Unzip/extract the file to its own folder:
C:\Silent Runners.
3. Right-click (choose to run as Administrator) the SilentRunners.vbs inside the folder or on your desktop
to start.
4. A message box will appear asking if you want to skip the supplemental
searches.
5. Press "Yes" to skip [default] or "No" to include them.
6. Another message box will appear saying: "Silent Runners has started. A
message box like this will appear when its done." The tool will scan your
system and create a log by default, in the same directory as the script or
on your desktop. The log is named "Startup Programs (ComputerName)
date/timestamp.txt".
7. When finished, the next message to appear will say: "All Done! the
results are in the file..." (it will provide the full path location of the
log.
8. Copy & paste the log in your next reply.

Note: If you have a script blocking program you may get a warning asking if
you want to allow the script to run. Some will say "malicious script
warning" or something to that effect. There is nothing malicious about this
script, you can click to allow it to execute.

Thanks Jacee. The OP is Fruitloop.