Solved USB device connected, odd folders automatically created + error msgs

[Rhaxia]

Hello Everyone!!

I'm a new member here to the forums! I've have used sevenforums in past, as an unregistered user for help on various win7 issues, so I'm very grateful to all the help/work you all do! Unfortunately, I've come across an unexplained issue going on whenever I have a USB device connected, and I'm hoping to receive some help and/or solution to my issue. Please bear with me if this post happens to be a bit long!

It all started all last week after I inserted my niece's USB flash drive to my computer. I was adding some files to her USB flash drive. I created a new folder, named it, and started adding the files. All of sudden, random empty folders were being created automatically in the folder I was transferring files to. The folders resembled user folders to me, as they were titled "My documents", "My videos", "My pictures". As soon as I deleted the empty "My docs/vids/pics" folders, they would reappear and/or be recreated again several minutes later. I ended up trying to delete the folder I created on her USB drive, and it would recreate itself again, with all the "My docs/vids/pics" subfolders intact. Ignoring the issue, I just transferred the files over to her USB flash drive and called it good.

Earlier today, I connected my external HDD (Western Digital 1TB) to my computer, and similar issues started to pop up. I had a folder with the same exact title name as the folder I created on my niece's USB flash drive, and likewise, the mysterious/empty "My documents/pictures/videos" folders started to appear in the same named/titled folder on my external HDD. I would delete the "My docs/vids/pics" folders, and they were recreated automatically several minutes later. Frustrated, I transferred the files contained in the folder on my external HDD to my D/Data drive, and deleted the problematic folder off of my external HDD. The folder once again recreated itself minutes later, with the all the "My docs/vids/pics" subfolders in it.

Aside from that particular issue, I noticed while having my external HDD connected via USB, I was getting random messages from Western Digital's USB software saying that my external HDD had been disconnected (happened when I was transferring some files over). I would try to reconnect it via the WD software, only to get a message saying that the device was already connected and was working fine. A little while later, I got a random Windows "please format disk" message at same time I had been viewing the files stored/saved on my external hard drive.

I am quite stumped as to why this is happening, but I have an idea that it stems from when I inserted my niece's USB flash drive to my computer last week. I'm not sure if this is a USB driver/port or windows issue, but seems like I can't use and keep a USB device connected without weird things happening.

On an unrelated note, I did install a 2nd new internal hard drive last week on my computer for personal files, replacing/deleting the data partition I had been using previously. I'm not sure if any of this would come into play with my current issue, but I thought I'd throw it out there.

If anyone has any ideas or solutions, please let me know! I appreciate all the help, and thank you to all who happens to read my entire post!!

 

[GokAy]

It smells like an infection (not sure though), scan with Malwarebytes Anti-Malware free (enable root-kit scanning too, settings - detections).

Disable AutoPlay for now, Control Panel - AutoPlay - uncheck "Use AutoPlay for all..." at the top.

And perform a clean startup - http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Edit: Not sure disabling AutoPlay disable all autorun, see https://support.microsoft.com/en-us/kb/967715

 

[mitchell65]

Hi Rhaxia and welcome to the Forum. It looks like you "collected" a nastie possibly from your niece's flash drive. Golden rule is when you need to access somebody else's CD , Flash Drive, External Hard drive or whatever always scan it with your A/V. Just connect the device, NO NOT OPEN ANY FOLDER OR FILE just right click it and you will see in the context menu that opens your A/V. From that you will be able to scan the device. Only open it if it is shown to be clean. It's good practice to do this from time to time with your own devices especially if they have be connected to a different PC! What A/V have you installed on your PC and is it up to date?

 

[Rhaxia]

It smells like an infection (not sure though), scan with Malwarebytes Anti-Malware free (enable root-kit scanning too, settings - detections).

Disable AutoPlay for now, Control Panel - AutoPlay - uncheck "Use AutoPlay for all..." at the top.

And perform a clean startup - http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Edit: Not sure disabling AutoPlay disable all autorun, see https://support.microsoft.com/en-us/kb/967715

Thank you, I will do a rescan with MalwareBytes with this option enabled. I'm a bit hesitant to disable autorun, but I will take it into consideration! Also, I've never heard of clean startup, but it might be something worthwhile to try.

 

[Rhaxia]

Hi Rhaxia and welcome to the Forum. It looks like you "collected" a nastie possibly from your niece's flash drive. Golden rule is when you need to access somebody else's CD , Flash Drive, External Hard drive or whatever always scan it with your A/V. Just connect the device, NO NOT OPEN ANY FOLDER OR FILE just right click it and you will see in the context menu that opens your A/V. From that you will be able to scan the device. Only open it if it is shown to be clean. It's good practice to do this from time to time with your own devices especially if they have be connected to a different PC! What A/V have you installed on your PC and is it up to date?

Thank you! I'm glad to have joined! Thanks for suggesting to run an AV scan, and I'll keep what you said in mind, since I'm more used to just inserting a USB device to my computer without thinking it's infected. I know that things just started to act up after I inserted and was using my niece's USB flash drive on my PC, it just didn't occur to me later on that connecting/using my own external HDD to/on my computer would cause issues after using my niece's USB flash drive last week.

I'm using Avast Free Antivirus 2015, and as I checked, it wasn't quite up to date as I thought (requires a computer restart, which I will end up doing). Do you recommend running an AV scan on my external HDD?

The external HDD is currently being used as a windows backup drive for win7. I did have a bunch of personal files on there yesterday, but moved most of them off my external HDD, as I was dealing with the weird folder issue + multiple error messages. My external HDD is password-protected, so I'm guessing it's just a matter of unlocking the drive and running an AV scan on it? I did do an in-depth scan on my C/OS drive overnight just a few days ago, but Avast didn't find anything out of the ordinary. I guess it doesn't hurt to another rescan of my C/OS drive and possibly my external HDD, all while making sure my AV is up to date.

I hope I can be one step closer to resolving this issue. It's been a bit frustrating trying to access/use my external HDD, as I was intending/considering to perform a windows backup. It just seems a bit hard with everything that's been going on.

 

[Rhaxia]

Update:

I ran an antivirus scan and ran Malwarebytes on my external HDD (scan found some PUPs on my old backups from an old program I had used previously, my external HDD is my windows backup drive), but other than that, neither scan showed anything else that could possibly be related to my current folder issue. I tried deleting the folder, and about 20 to 25 minutes later the folder recreated itself again. On the upside, I've managed to access and use my external HDD without running into issues with error messages, unlike yesterday where I was running into all sorts of error messages.

I got curious and decided to look at the folder permissions, and they looked a bit odd when I compared it to the permissions of other folders on my computer. I'm not familiar with user permissions on folders, but would I need to change the permissions at all to permanently delete the folder on my external HDD for good? and without the folder having to recreate automatically on its own each time? The only user permissions listed that had the most access was "everyone" and "system". "Creator owner" and "administrators" only had special permissions checkmarked, while everything else on the list was blank.

I'm not sure if the user folder permissions has anything to do with the reason as to why the folder on my external HDD keeps being recreated on its own after I manually delete it, but I hope someone can clarify things a bit more for me.

Thank you everyone for all your help!

 

[GokAy]

There is a clean startup link in my post above - #2.
Disable all Startup and non-MS services as described in the tutorial.

Permissions seem alright.

 

[Rhaxia]

There is a clean startup link in my post above - #2.
Disable all Startup and non-MS services as described in the tutorial.

Permissions seem alright.

Hi GokAy! Thank you for your help! I will try your suggestion. I'm not very familiar with a clean startup and what it does, but if the steps described are the steps I should take to attempt to resolve my issue, then it is something I'm willing to try out! Do you recommend that I follow the tutorial and try to delete the folder on my external HDD while in a clean startup mode? I hope I'm understanding this correctly.

 

[GokAy]

Yes please delete but only after disabling entries in msconfig (detailed in the tutorial) and restarting. Keep your antivirus entries enabled by the way. A quick google search will reveal what the entry is about if you can't distinguish yourself.

 

[Rhaxia]

Yes please delete but only after disabling entries in msconfig (detailed in the tutorial) and restarting. Keep your antivirus entries enabled by the way. A quick google search will reveal what the entry is about if you can't distinguish yourself.

I see, thank you! I will be trying this out and I will see what happens! Hopefully this will work!

 

[Rhaxia]

Update 2:

I tried doing a clean startup and disabled autorun, but my problem still persists. The nuisance folder is still creating itself automatically on my external HDD after it's been deleted several times. I've ruled out it being a virus/malware issue. I'm not quite sure where to go from here. If anyone has any ideas, please feel free to give me a suggestion! I appreciate the help! Thanks!

 

[mitchell65]

I don't think you can rule anything out at this stage especially not some malware, trojans or some other nasties. If I were a betting man I would put money on a malware issue of some sort. You say that you tried doing a clean start up but did you succeed? I think the best we can do is ask for this thread to be moved to the security section of the Forum so that one of the security experts can have a look at it but if they do and they make suggestions it is important that you follow their recommendations to the letter and if there is anything you don't fully understand please go back to them before proceeding. Much better that you fully understand what is said before proceeding. Nobody will mind how many questions you ask, it is important to get it right!

 

[Rhaxia]

I don't think you can rule anything out at this stage especially not some malware, trojans or some other nasties. If I were a betting man I would put money on a malware issue of some sort. You say that you tried doing a clean start up but did you succeed? I think the best we can do is ask for this thread to be moved to the security section of the Forum so that one of the security experts can have a look at it but if they do and they make suggestions it is important that you follow their recommendations to the letter and if there is anything you don't fully understand please go back to them before proceeding. Much better that you fully understand what is said before proceeding. Nobody will mind how many questions you ask, it is important to get it right!

Hi Mitchell65! My antivirus scan and Malwarebytes didn't find anything when I scanned my external HDD. Doing running a clean startup and going through the process, it seemed to work until I went through the startup list portion of the tutorial. I did that portion of the tutorial as is, testing it as I went along, but the issue still occurred.

I have noticed that lately the folder is creating itself at random intervals after I deleted the folder (anywhere from a few mins to a few hours while the external HDD is plugged in). I've also tried disabling autorun and that didn't do much either, the problem still persists. At this point, I'm just very unsure (probably more so than I was at the beginning of all of this) whether it's a virus/malware issue or something else.

 

[GokAy]

Doesn't MBAM scan whole PC? If you are only scanning external that may be the issue, you should scan C if nothing else, scan whole PC though if you haven't.

We weren't sure if it was malware too, it is never good something happens on its own

 

[Rhaxia]

Doesn't MBAM scan whole PC? If you are only scanning external that may be the issue, you should scan C if nothing else, scan whole PC though if you haven't.

We weren't sure if it was malware too, it is never good something happens on its own

Hi GokAy! I did do a scan with Malwarebytes on my C/OS drive the day I started having issues, but it didnt find anything. I also did a custom scan on my external HDD, and it also didn't find anything there as well.

I'm grateful for all the help you and mitchell65 have given me so far! I do agree with you in that it's not good that something is happening on its own. This problem has really stumped me the last few days, as I've never come across an issue like this before.

I'm just wishing and hoping to find a solution to my problem. In some ways, I feel that the timing of this sucks, as I've been trying to prep my computer to upgrade to win10. I might just have to wait, I'm still a bit unsure whether to upgrade to win10 or not. I just know that I would rather get my current issue resolved, than to have the problem still occur after I do the upgrade to win10.

 

[GokAy]

Tough call about W10 upgrade

Please try in Safe Mode too. And consider asking in Security section about this, they may not be watching this section regularly.

 

[Rhaxia]

Tough call about W10 upgrade

Please try in Safe Mode too. And consider asking in Security section about this, they may not be watching this section regularly.

I see. I will do that, hopefully they'll be able to help me out! Thanks for all your help!

 

[mitchell65]

I did, in fact, ask for this thread to be put in the Security Forum but to no avail!

 

[Rhaxia]

I did, in fact, ask for this thread to be put in the Security Forum but to no avail!

It's ok, I went ahead and created a new post over there

Though, just to let you know, someone over there suggested to check out the libraries, as they had suggested that the libraries were directed/pointed to the folders on my external HDD. It wasn't the case, but I stumbled upon my user folder a few hours ago, and found that the My docs/pics/videos folders were linked/directed to the folders on my external HDD. I'm not sure if I found my problem, but it might be? I'm not quite sure how the user folder works or how those folders got directed from my user folder to folders on my external HDD in the first place, as I keep my all my personal files/folders on my 2nd internal HDD (separate from the C/OS drive).

 

[Rhaxia]

Update: My problem is solved! Turns out it had to do with my user folder, and I redirected the folders to point to my D/Data Drive, and they haven't shown up on my external HDD. I just want to thank you all for your help!