View original (French)

How to prevent automatic creation of a file on an external drive?

tetenlair1967 Posted messages 10 Status Member -  
Kiraxellix Posted messages 153 Status Member -
Hello.
On an external hard drive (and a copy on the PC), there was a folder "zz_ a_trier_photos" that contained photos.
The photos were moved, the folder was deleted (both on the external drive and on the PC's hard drive).
My problem: as soon as I insert a USB drive or a memory card into the PC, a folder is automatically created on the inserted external drive.
Virus? possible, but then not detected
How to prevent this?
Thanks in advance?

3 answers

  1.
    Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 713
     
    Hi,

    Which folder is automatically created?

    --
    Please press any key to continue disinfection...
    0
    1. tetenlair1967 Posted messages 10 Status Member
       
      Hello. The folder "zz_ a_trier_photos", which existed on the PC but was deleted long ago, is created on every card or external drive that is connected to the PC.
      0
      1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 713 > tetenlair1967 Posted messages 10 Status Member
         
        This is not a system folder, there is no reason for it to be created automatically.
        Finally, if it is an application, I don’t see which one.
        0
      2. tetenlair1967 Posted messages 10 Status Member > Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention  
         
        Hello. I don’t see it either. (otherwise I wouldn’t ask the question on the forum, by the way).
        It’s an old folder that contained photos: so it’s neither a system file, nor an app
        0
      3. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 713 > tetenlair1967 Posted messages 10 Status Member
         
        Format the support.
        0
      4. tetenlair1967 Posted messages 10 Status Member > Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention  
         
        The problem: it’s the PC that “infects” the media that are inserted into it (USB flash drives, external hard drives, SD cards).
        That’s why I’d like to find where the folder on the PC is hidden, or the file that issues the command to create this folder on the external drives.
        0
  2. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 713
     
    humm ok,

    To check your computer, for potential infections and to have an overall system status:

    Follow the FRST tutorial by clicking on this blue link. ( take the time to read carefully - everything is well explained ).

    Download and run the FRST scan,
    Wait for the scan to finish, a message will indicate that the analysis is complete.

    Three FRST reports will be generated:
    • FRST.txt
    • Shortcut.
    • Additionnal.txt


    Submit these 3 reports on the site https://pjjoint.malekal.com/ and in return provide the 3 pjjoint links that lead to the reports here in a new reply so that we can review them.

    (The blue links lead to step-by-step explanatory tutorials, click them to get more precise instructions to follow).

    --
    Please press a key to continue disinfection...
    0
  3. Kiraxellix Posted messages 153 Status Member 16
     
    I don’t get the impression this would be a virus doing that... what’s the benefit for the virus?

    1) Try searching everywhere on your PC for the file "zz_ a_trier_photos"... is there a copy somewhere, in a dark corner of the computer? If yes, delete it permanently, so we don’t talk about it anymore.

    2) Watch your Windows services. Check if there isn't a suspicious service that does something odd when a USB device is plugged in.

    3) Watch your Task Scheduler. Is there a scheduled task that does this every time removable media is inserted? Specifically look at your active tasks, and see if any are suspicious.

    Steps 2 and 3 are much longer than step 1, so courage!
    0
    1. tetenlair1967 Posted messages 10 Status Member
       
      the file no longer exists on the PC (at least, I can’t find it via “search” nor by digging through the explorer). As for the services: you need to know what to look for to determine what should or shouldn’t be executed (that’s not my area). I don’t see anything like “create file XXX” when inserting a drive.
      0
    2. Kiraxellix Posted messages 153 Status Member 16 > tetenlair1967 Posted messages 10 Status Member
       
      You can check your Task Planner by looking at the history of executed tasks, and by looking at what ran “around” the time the undesirable folder was created.

      Moreover, if you’re afraid of touching your service manager: do a system restore point. At worst, if you really touched something you shouldn’t have, you can always backtrack.
      0
    3. tetenlair1967 Posted messages 10 Status Member > Kiraxellix Posted messages 153 Status Member
       
      for me, touching the service manager is Chinese.
      As for the created folder, it always shows the same date (I think). So I don't know how to see what happened in the task history.
      0
    4. Kiraxellix Posted messages 153 Status Member 16 > tetenlair1967 Posted messages 10 Status Member
       
      Right-click the folder to see the creation date. Anyway, what’s causing your problem is either - an application, a program - or a process - or a scheduled task - or a service. So figure out what’s generating your problem, and if needed go as far as the services. But most services are associated with processes. In the first step, you can “kill” with the Task Manager ALL processes, one by one, that are not essential (for example, I don’t know, the process that handles the webcam). Don’t worry—the next Windows startup everything will be normal again. Then, check if the folder is created again. If the problem no longer triggers, it means the right process was killed. You will then have to sift through what you killed to find the thing that caused your problem. Next, see what starts this process: the Task Scheduler or a Windows service? (Generally, the services have the same name as the process in question). If it’s a service, disable it in the Services manager. If it’s a scheduled task, delete it in the Device Manager. And your problem will disappear.
      0
    5. tetenlair1967 Posted messages 10 Status Member > Kiraxellix Posted messages 153 Status Member
       
      having 68 background processes, it will take time. Because, as I understand it, I must:
      - remove the external hard drive / USB stick.
      - erase the folder on another PC
      - stop a service
      - reinsert the USB on this PC
      - check if the folder was created or not (on another PC)
      and repeat these 5 steps for the 68 services in progress
      0