A program is creating root files without my consent

Bigsin781 · Feb 6, 2017

So within the passed week, a folder began being created without my knowing how it got there in my C: drives main root. I delete the folder and it's contents, but it keeps being created. It's also worth noting it's filled with odd files, with random names and file types. As well, the folders name changes each time, all the files change, but the folders name always has an X in the beginning.

Paul NZ · Feb 6, 2017

I would scan your system for malware. Try adwcleaner run it click on scan. Wait for it to finish then click on clean

Then reboot run it again then file menu / uninstall

Dark Lord of Tech · Feb 6, 2017

I think he has already been running ADW since it's one of his folders.

Bigsin781 · Feb 6, 2017

I actually haven't ran it since this began, trying it now and yielded 6 results so far, awesome. I am an idiot. I should note though, I figured it was a symptom of another, longer running issue that's been occurring.

The final verdict, 6 items found, issue is persisting, after scanning, nothing else being found. I have malware bytes, mbam rootkit scanner, the program you advised me to get, which yielded the results, iobits advanced system care, all of which are now finding nothing. I fear a re-partitioning of my system may be in order.

Dark Lord of Tech · Feb 6, 2017

http://downloads.tomsguide.com/herdProtect,0301-62355.html
USES 68 SCANNING ENGINES ^

Paul NZ · Feb 6, 2017

Also update ADW if it's not 6.043

Bigsin781 · Feb 6, 2017

Paul NZ :

Yes, just downloaded the newest. versions.

Bigsin781 · Feb 6, 2017

So, I scanned, it found 2 actions, now, the issue is persisting, and it's actually gotten worse haha.

Again, no idea what these files are, and aaahh not gonna click any of them.

Dark Lord of Tech · Feb 6, 2017

At this point , backup if you need to and reinstall windows.

Bigsin781 · Feb 6, 2017

Hypothetically, since I can't afford a new copy of windows until friday, how bad would it be? Also what should I avoid between now and friday? Like this is my main gaming PC, plus I pay bills and such from it. Like no more typing passwords, or like what extent, what should I avoid doing?

Dark Lord of Tech · Feb 6, 2017

I wouldn't pay bills on it , and just install 10 , you can do it from an ISO or USB , activate it when you get the new purchase on Friday.

What windows are you running?

Bigsin781 · Feb 6, 2017

Win 7. Also, should I re-partition both c and d drives?

Dark Lord of Tech · Feb 6, 2017

Partitioning is up to you , whatever you do don't use it for banking till you reinstall.

Bigsin781 · Feb 6, 2017

Since this started happening, I did log into credit card companies to make payments. I should contact all 3 and change my information as soon as possible?

Dark Lord of Tech · Feb 6, 2017

Not sure if it's warranted or not , I would monitor the accounts closely.

Bigsin781 · Feb 6, 2017

You, SR-72 Blackbird, are a boss, thank you for your time!

Dark Lord of Tech · Feb 6, 2017

Glad to help , good luck with the reinstall and thanks for posting.

Bigsin781 · Feb 6, 2017

Update:
So I went on an un-install spring, and nothing was helping, then I uninstalled the program featured in this LifeHacker article
http://lifehacker.com/ransomfree-proactively-protects-your-computer-against-r-1791429681

LO AND BEHOLDEN!! The files are gone and not coming back. So I'm almost 90% sure it was that program.

Paul NZ · Feb 6, 2017

Lucky you caught it in time. It may have locked you out. And you would have had to pay to get them back

Bigsin781 · Feb 7, 2017

I think because I had a solid state and install most things on D: drive, it wasn't able to lock my system down.

A program is creating root files without my consent

Commendable

Polypheme

Retired Moderator

Commendable

Retired Moderator

Polypheme

Commendable

Commendable

Retired Moderator

Commendable

Retired Moderator

Commendable

Retired Moderator

Commendable

Retired Moderator

Commendable

Retired Moderator

Commendable

Polypheme

Commendable

Share this page