Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Weird user folder


  • Please log in to reply
5 replies to this topic

#1 juli_bo02

juli_bo02

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:56 AM

Posted 18 December 2016 - 01:20 AM

Hi

My "recent files" showed up a strange name folder, called "PHOTOS". When I checked the properties of the folder, it was in D: \ with a computer name different from mine, from a user I've never seen. It is an empty file. 

What can it be? Is it dangerous?



BC AdBot (Login to Remove)

 


#2 MichaelV702

MichaelV702

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:56 AM

Posted 18 December 2016 - 05:51 AM

There can be some factors that would make such a random event "Dangerous" if you're seeing random files added to your computer recently it could be from:

 

  • Malware/virus
  • Remote connection to your computer (backdoor access)
  • Un-authorized person(s) on your network within a group or sharing software that has the permission to write files

However,

 

There are less threatening reasons that folder has appeared recently:

  • You or someone with access to your network (Family or Guest) has a: Network drive, Printer or some other network sharing software that created the folder over the network to share "PHOTOS" in common cases some newer model printers have SD CARD slots on the front of them and even USB Ports similar to your computer. In my experience I've worked with customer's with similar concern - I've also owned HP, EPSON & CANNON Printers with such ports and when I set them up to print on my network they create a new drive which in your case could possibly be "D:\" and contain a folder with a name of "PHOTOS"

 

So for me to get the best "Big Picture" here for maybe a better answer let me ask you these questions:

 

  1. Have you made any hardware or software changes to your computer recently *Including adding of a new printer? (If so did the folder show up after)
  2. Aside from that drive "D: \" and the "PHOTOS" folder, have you noticed random files or other drives anywhere else?
  3. Is your computer showing any symptoms of: Slowness, pop-ups or any errors after discovering that drive/folder?
  4. Do you have security software on your computer? (Anti-virus software) if so what is the name of it? (Example: McAfee, Norton, AVG, Webroot, etc.)
  5. On your desktop, are there any icons/shortcuts recently added that you do not recognize as "Normal to you" or something out of place?

*If you do not have an anti-virus or security software I'd personally recommend Malwarebytes which you can find by searching for it on the downloads section and install it, you'd then run a "Threat Scan" option in the scanning tab of Malwarebytes and clean anything it finds, if you have "Special activation or patches on software" be careful as security scans with any security product may clean those. (Just my little disclaimer on that)*

 

Feel free to reply to the best of your ability on my questions and I'll do what I can to help ya!  :)


Edited by MichaelV702, 18 December 2016 - 05:53 AM.


#3 Ferencc

Ferencc

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vaduz
  • Local time:10:56 AM

Posted 18 December 2016 - 08:46 AM

I think that the consequences of some kind of virus that may have been deleted, and may still exist in your computer.



#4 MichaelV702

MichaelV702

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:56 AM

Posted 18 December 2016 - 02:16 PM

I think that the consequences of some kind of virus that may have been deleted, and may still exist in your computer.

As you're reply is entirely possible and can be correct.

 

Juli I'd recommend looking at the issue with an open mind that some of the point I mentioned earlier can be simply from a software or hardware related device on your network if you recently added one "Like a printer" which commonly create a drive and folder "PHOTOS"

 

It never hurts to just use your security (Anti-virus software) to run a scan/check of your system to be on the safe side as well.



#5 juli_bo02

juli_bo02
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:56 AM

Posted 18 December 2016 - 08:46 PM

There can be some factors that would make such a random event "Dangerous" if you're seeing random files added to your computer recently it could be from:

 

  • Malware/virus
  • Remote connection to your computer (backdoor access)
  • Un-authorized person(s) on your network within a group or sharing software that has the permission to write files

However,

 

There are less threatening reasons that folder has appeared recently:

  • You or someone with access to your network (Family or Guest) has a: Network drive, Printer or some other network sharing software that created the folder over the network to share "PHOTOS" in common cases some newer model printers have SD CARD slots on the front of them and even USB Ports similar to your computer. In my experience I've worked with customer's with similar concern - I've also owned HP, EPSON & CANNON Printers with such ports and when I set them up to print on my network they create a new drive which in your case could possibly be "D:\" and contain a folder with a name of "PHOTOS"

 

So for me to get the best "Big Picture" here for maybe a better answer let me ask you these questions:

 

  1. Have you made any hardware or software changes to your computer recently *Including adding of a new printer? (If so did the folder show up after)
  2. Aside from that drive "D: \" and the "PHOTOS" folder, have you noticed random files or other drives anywhere else?
  3. Is your computer showing any symptoms of: Slowness, pop-ups or any errors after discovering that drive/folder?
  4. Do you have security software on your computer? (Anti-virus software) if so what is the name of it? (Example: McAfee, Norton, AVG, Webroot, etc.)
  5. On your desktop, are there any icons/shortcuts recently added that you do not recognize as "Normal to you" or something out of place?

*If you do not have an anti-virus or security software I'd personally recommend Malwarebytes which you can find by searching for it on the downloads section and install it, you'd then run a "Threat Scan" option in the scanning tab of Malwarebytes and clean anything it finds, if you have "Special activation or patches on software" be careful as security scans with any security product may clean those. (Just my little disclaimer on that)*

 

Feel free to reply to the best of your ability on my questions and I'll do what I can to help ya!  :)

Thank you for replying! For questions 1, 2, 3 and 5 the answer is no. Also, I have Avast, but I will install the recommended anti-virus.

If the problem is related to one of the points below, what do you suggest?

  • Remote connection to your computer (backdoor access)
  • Un-authorized person(s) on your network within a group or sharing software that has the permission to write files

Edited by juli_bo02, 18 December 2016 - 08:46 PM.


#6 MichaelV702

MichaelV702

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:56 AM

Posted 18 December 2016 - 09:19 PM

The next steps I'd say you should take is run a full scan on your Avast security software (allow it to complete) then run a scan with Malwarebytes 2.0 (If you download malwarebytes from here on BC instead of the malwarebytes direct site it will be 2.0) when you run the scan on Malwarebytes use the "Threat Scan Option" in the scanning tab.

 

Feel free to post results of those scans (If its just a few results just copy paste the names and locations in a reply) if you're unsure what to remove. In most cases with Avast and Malwarebytes you can just clean anything it finds unless you notice a false positive in the detection list nearing the end of scans.

 

As for verification after scanning, you can use tools like Process Explorer and "netstat -a"

 

Process Explorer is like a more detailed and helpful advanced version of Task Manager you can really see what is going on in your system.

 

"netstat -a" is a command you would run in a command prompt window without the quote marks you can copy and past it in there, it will then generate a long list of connections made to your computer. If you're not familiar with how to review this list you can copy + Paste the results in a reply I believe the forum rules is to not attach files for safety reasons so with command prompt you can use: "CTRL + A" key (this will select all the text in the box) and then "CTRL + C" (This will copy the selected text) you may then simply paste it into the reply window.

 

As for Process Explorer, being unsure of whether not something is legit can be difficult so instead if you wish you can use DDS (download from BC here) run the tool and when it completes you'll have 2 txt files on your desktop: "DDS.TXT" and "ATTACH.TXT" feel free to add those to the reply I can take a peek at what's going on.

 

Please be sure when you're going to provide me with the DDS and Attach file information within that you DO NOT ATTACH THE FILES TO THE REPLY. I'm new to the forums here and apparently tools with reports like the DDS one I recommended can only be uploaded in a post on the Malware/Virus section as announced here so to stay compliant with the forum rules just copy and past the text of the files in 2 replies to keep it neat of each file in text format only.

 

We're currently only in the Windows Support section with this conversation so we would need to be careful when posting about Malware :) its also likely it could get moved by a Mod anyways to that section.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users