Solved Chas' computer is moving folders around!

[AlaskaRick]

My elderly friend called me with this problem. "My file is gone". I remoted in (via TeamViewer) and showed him how to 'search' for the file instead. No surprise-- the file was there.

But not in the proper folder. Of course I assumed that he moved them around via user error.

But-- when I went over to his home I realized that something very wrong was indeed going on! Entire folders had moved since I remoted in 2 hours before.

He is an architect and stores his project files in 2 folders --- Group1 and Group2. The reason Chas could not find his file was because Group2 had moved, and was now inbedded in Group1. Formerly Group1 and Group2 were at the same hierarchal level. I could see how this could have been done via user error.

When I arrived at Chas' home things had changed again! Now Group1/Group2 folder was inbedded in a new folder, "MarcusWelby". The folder MarcusWelby was created minutes before. Chas recognised the name --- it was the name of a word document-- but was not in any special folder-- was just in MyDocuments.

So-- His computer is not only moving files around but is also creating new folders and moving his older folders into the new!

I have been protecting Chas with the same as my computers-- I use Malwarebytes and Microsoft's antivirus programs.

Any help is very much appreciated!! Thank you--- Rick

 

[AlaskaRick]

Chas' computer:
Is a Toshiba laptop running 64 bit Windows 7 .
Using MS Office 2010.
Autocad Lite ver 10.

 

[mrjimphelps]

I really don't like to say something like this, but is it possible that your elderly friend is confused when he is using the computer? If so, then he might be doing the things that you are seeing, and not remembering what he did.

That's what it sounds like to me.

When you said that one of the folders was named "MarcusWelby", I immediately thought "hacker" or "virus". But then when you said that one of his documents is named that, I concluded that it was likely that he himself named the folder that. Perhaps he thought he was doing a 'save as', when actually he was renaming a folder.

 

[AlaskaRick]

93 but sharp!

Yes Chas is 93 years old-- and mentally SHARP!

The file MarcusWelby, he said, he hasn't used for years. It's properties confirmed this.

The folder MarcusWelby had a last modify date of a few hours old. Is was very recently created.

I really think the laptop is running amock via a serious harddisk/filepointer issue or, malware infection.

Has anyone EVER seen this. I have Googled a lot! Absolutely no 'hits'.

Thanks-- Rick

 

[Barman58]

You could run whatever anti Malware suite is running on the system and perform a deep /full scan and see if anything comes up, although I've not heard of this sort of malware "payload" since the days of Windows 3.x, Then it was mostly down to IT students creating Viruses for "Fun".

I have seen this sort of result down to non Malware reasons, it's often seen on laptops where a touchpad is used. The issue is it's simple to accidentally drop a file or folder somewhere after picking it up (sometimes with the hell of the hand not the fingers). I've also managed to do this myself with a mouse, (and a pen tablet), and it's not down to mental acuity but physical dexterity, or just bad luck .

 

[AlaskaRick]

Nigel-- I hear you-- physical dexterity does come into play!

But--- that would not explain how a brand new folder was created (the MarcusWelby folder).

And yes-- I did deep scans immediately-- not bad guys found.

 

[Barman58]

I can't explain the creation of the "new" folder but it may be older than it seems. I have seen applications change the wrong field in the file dataset where rather than the last modified field the modified date is inserted in one or other of the other data fields, thus confusing the issue totally.

I would always suspect the good old human error, I know that my system is organised but I could not say if I created a file with a particular name or a file and a folder to match.

I actually go a step further than most and regularly start a folder or file name with a four digit reverse date, today's file would start with 180507, (UK date system), and means that files are always ordered by date. I have seen these files show incorrect created dates, when I know exactly when they were created

 

[lehnerus2000]

Does the PC have some sort of file/folder synchronisation software?

 

[AlaskaRick]

No-- nothing onboard like that.

 

[AlaskaRick]

I found this >>>> MalwareTips Forums while googling for malware. They want me to run "Farbar Recovery Scan Tool" before I start a new post. Can anyone vouch for these folks? This is where you go when you start to download the Tool >>>
Download Farbar Recovery Scan Tool .

Again-- anyone have experience with these guys??

 

[Barman58]

They're fine but I would always use Bleeping Computer , it's the site that the pros use, and run - Follow instructions precisely, ( they can get a little confusing to a non specialist, but the AV manufacturers ask for their assistance at times so they know what they are doing).

I think that one of their senior members actually wrote Farbar

 

[AlaskaRick]

I am marking this "solved"-- even tho it is not.

Why??--- Because I have started a thread on BleepingComputers and one of their rules is that I don't ask for help from another source-- so as to not get conflicting opinions.

Wish us luck!!!

 

[mrjimphelps]

I'll bet if you include in your post there that you also have a post here, but that we are stumped, they will cut you some slack on the multi posting rule. The main purpose of that rule is to keep from getting people to do unnecessary work. So, for example, if we are working on your issue, BleepingComputers won't need to at this time; and vice versa.