Mysterious files and folders appearing - Are they Malware?

[johnblood]

Hi,

I was looking for files on my Windows 7 desktop when I stumbled on a strange folder in my "Documents" folder. The contents looked like a dictionary had thrown up. There were 10 files and each had a random string of nouns. Attached is a screenshot. I found two similar folders in C:\ and C:\Users. My antivirus software (Avast) says that there is nothing wrong with the folders. Is this malware? If so, any idea which one and how I can fix it?

 

[torchwood]

Hi John,

suggest you run these 3 progs, delete what ever they find
Malwarebytes | Free Anti-Malware & Malware Removal
AdwCleaner Download
Junkware Removal Tool Download

for a further backup run this tool cop/paste the 2 reports
Farbar Recovery Scan Tool Download

Roy

 

[johnblood]

I ran the first three and quarantined/deleted over 500 PUPs. However, I tried to delete the mysterious files using Eraser (https://eraser.heidi.ie/), but they just appear again. I just realized that these several of the mysterious folders have names similar to another folder, ie 2011 Absystem155 and 2011 Accounting. The folders are set to "Read-only" and "hidden". Could this be a ransomware program encrypting my system? Cyberrason RansomFree hasn't found anything.

 

[johnblood]

Also, I rebooted into safe mode to run those scans again. I checked and the files and folders were gone. However, when I rebooted, I watched the folders reappear. The folder names were the same, but the contents were different. Please Help.

 

[torchwood]

please run the other program, currently believe thier is a RootKit on you machine, based on your last posts.


run this program as well
RKill Download


Roy

 

[johnblood]

Here are the results from FRST.

 

[johnblood]

here is the result from Rkill.

 

[torchwood]

Hi John,

Im NO security expert, but im not to happy at whats been reported.
A rootkit, and many unsigned files.

Please jump over to BleepingComputers - Am i infected subforum
post the logs and anything you feel relevent about programs you have installed.


Roy

 

[johnblood]

• Scan with this program https://www.malwarebytes.com/mwb-download/thankyou/
  

If this helps u let me know.

I've already installed and run a scan with MalwareBytes and removed everything.

 

[General Erton]

Okay so then the only chance is the internet but don't worry i think they're nonmalwared so u can research a little more for those programs.But if u have any biiling account check that because some materials had billing info that by my research results...

 

[johnblood]

I think that those have comed there just by a USB so by a flash drive.If someone just putted a USB materials monstly percen are in computer by there

I think there is more to it than that. I'm the only one who sticks USB drives into this PC. Not ready to mark as solved, just yet.

 

[torchwood]

Pretty sure your right John, did you do as i said in my earlier post.

Roy

 

[johnblood]

torchwood I did post the information on BleepingComputer (Windows 7 Infection creates mysterious folders that regenerate when deleted - Virus, Trojan, Spyware, and Malware Removal Logs), but haven't gotta reply yet.

 

[DonnaB]

Hi johnblood,

Those mysterious files and folders are a result of the CyberReason RansomFree program that you have installed. See here and here. Nasdaq did a fine job cleaning you up. I don't think you have anything to worry about. Just follow the instructions in the link he provided for best security practices and you'll be fine.

Donna

 

[tonymiller60]

I had this exact same issue on my work laptop, and the help desk had no clue - until I found an article on the company web page saying they deployed Cybereason software a few months ago. Apparently they didn't think it was important to educate the Help Desk on handling these calls. Bottom line: These are benign "canary files" created by Cybereason anti-ransomware software.