Chas' computer is moving folders around!

My elderly friend called me with this problem. "My file is gone". I remoted in (via TeamViewer) and showed him how to 'search' for the file instead. No surprise-- the file was there.

But not in the proper folder. Of course I assumed that he moved them around via user error.

But-- when I went over to his home I realized that something very wrong was indeed going on! Entire folders had moved since I remoted in 2 hours before.

He is an architect and stores his project files in 2 folders --- Group1 and Group2. The reason Chas could not find his file was because Group2 had moved, and was now inbedded in Group1. Formerly Group1 and Group2 were at the same hierarchal level. I could see how this could have been done via user error.

When I arrived at Chas' home things had changed again! Now Group1/Group2 folder was inbedded in a new folder, "MarcusWelby". The folder MarcusWelby was created minutes before. Chas recognised the name --- it was the name of a word document-- but was not in any special folder-- was just in MyDocuments.

So-- His computer is not only moving files around but is also creating new folders and moving his older folders into the new!

I have been protecting Chas with the same as my computers-- I use Malwarebytes and Microsoft's antivirus programs.

Any help is very much appreciated!! Thank you--- Rick

Chas' computer:
Is a Toshiba laptop running 64 bit Windows 7 .
Using MS Office 2010.
Autocad Lite ver 10.

I really don't like to say something like this, but is it possible that your elderly friend is confused when he is using the computer? If so, then he might be doing the things that you are seeing, and not remembering what he did.

That's what it sounds like to me.

When you said that one of the folders was named "MarcusWelby", I immediately thought "hacker" or "virus". But then when you said that one of his documents is named that, I concluded that it was likely that he himself named the folder that. Perhaps he thought he was doing a 'save as', when actually he was renaming a folder.

Yes Chas is 93 years old-- and mentally SHARP!

The file MarcusWelby, he said, he hasn't used for years. It's properties confirmed this.

The folder MarcusWelby had a last modify date of a few hours old. Is was very recently created.

I really think the laptop is running amock via a serious harddisk/filepointer issue or, malware infection.

Has anyone EVER seen this. I have Googled a lot! Absolutely no 'hits'.

Thanks-- Rick

Nigel-- I hear you-- physical dexterity does come into play!

But--- that would not explain how a brand new folder was created (the MarcusWelby folder).

And yes-- I did deep scans immediately-- not bad guys found.

No-- nothing onboard like that.

I found this >>>> MalwareTips Forums while googling for malware. They want me to run "Farbar Recovery Scan Tool" before I start a new post. Can anyone vouch for these folks? This is where you go when you start to download the Tool >>>
Download Farbar Recovery Scan Tool .

Again-- anyone have experience with these guys??