Hi all:

I need some sage advice before confronting my son. His mom called me and said that she found an open folder titled "Visualizations" on her desk top. The folder contained hard core video files. Naturally, she thinks that my 17 year old son downloaded them. I told her I would talk to him, but before I do I'd like to know if anyone has heard of any virus or malware that might be responsible.

I find it strange that he would: (1) choose to put the files in a media player folder and (2) leave the folder open on the desk top. Why not make his own folder and put it in a different location? He certainly knows enough about computers to do this.

Does anyone know of a virus/malware that does this and if so what should I look for? I'm going there tomorrow and although I know that he may very well have downloaded the files, I don't want to accuse him if it was caused by something else!

Thanks in advance.

Visualizations are files which are used in media players in general and give'graphic movements on the beat of music played in that player. There are a few tricks to find out whether he has downloaded them.

a) From the browser- CTRL H This opens the history in any browser and gives you a run down on internet pages visited in that period
Rightclick the files propperties and look for dates when it was created . Most of the time there is a reference to a website.
c) If there is a date go to eventviewer ( START RUN type eventvwr ) and see whether there was anything downloaded around that period.
d) Alternatively go to the log of your firewall and see if anything crossed

Fons

Thanks for the tips. I'm going to be at that computer today and will check it out, but this will tell me only where they came from and not necessarily that he downloaded them correct? Also, would any program that you know of automatically save video files to that folder?

There are many possibilities of how those files got on the computer. Regardless of how they got there, malware should be suspected as porn is very often accompanied with malware.
Two good programs to scan with would be Super Antispyware and the online virus scanner Bit Defender. Both are free and fully functional.
http://www.superantispyware.com/ (use in safe mode)
http://www.bitdefender.com/scan8/ie.html


Just don't ask the Norwich, Connecticut police dept. for help!
http://www.bleepingcomputer.com/forums/topic79623.html

Hi again:

I checked out browser history which is blank (of course wiping the history is easy to do), the files are avi and mpg's and the most recent was created 01/08/07 - I'm not sure what that tells us as far as how they got on to this computer.

Also, I checked eventviewer and the firewall logs and found nothing suspicious like references to unfamiliar or questionable sites.

I will run Superantispyware and Bitdefender, but barring a confession from my son, is there any way to know for sure who or what placed the files on this computer?

Thanks.

Depends on how far you want to go. There are programs for recovering deleted files, logs, etc. Could compare log in times with download times, etc.
You could install a program to block porn sites such as the one in the link below. It is free for home use.
http://www.k9webprotection.com/about.html

Would payment of some sort be required for what was downloaded? I wouldn't know but someone else might.

Can't you see in the firewall logs what happened on that date?