Odd symbols for folder names

[edutech4schools]

Hello,

 

I have a user (win7) that keeps getting new folders created with odd symbols as the folder name. At first I thought it was corrupted existing folders but the folders are new and empty and only appear in folders that contain excel documents.

 

I have run ever virus / spyware scan I can find and found nothing.

 

Any ideas?

[rh91uk]

Have you tried removing the desktop.ini from the folder?

[edutech4schools]

Its more than one folder it seems to all the folders that have excel docs that this user has on the server. I will delete desktop.ini from these and see if they return.

 

Currently I am just getting the user to delete these folders but they slowly return.

[rvdmast]

Do his excel files contain macro's?

[localzuk]

Hello,

 

I have a user (win7) that keeps getting new folders created with odd symbols as the folder name. At first I thought it was corrupted existing folders but the folders are new and empty and only appear in folders that contain excel documents.

 

I have run ever virus / spyware scan I can find and found nothing.

 

Any ideas?

 

Can you elaborate on what you mean by 'odd symbols'?

[edutech4schools]

Sorry for the delay but only at school once or twice a week.

 

a. Some contain macros some don't

b. symbols can be ᴥ●■‼ or simply letters like ndy

[oxide54]

corrupted NTFS???

 

disk failure??

 

have you run chkdsk?

[Arthur]

I've seen rootkit's which create files and folders with symbols in their names. It might explain why your anti-virus didn't detect anything.

[oxide54]

I've seen rootkit's which create files and folders with symbols in their names. It might explain why your anti-virus didn't detect anything.

 

yes that sounds very likely.

 

RootkitRevealer

[Jaymate]

I've also seen it where a dodgy piece of memory can cause something similar.!

[oxide54]

are the files folders local? or on a server?

[edutech4schools]

Files are on a server but sync to laptop. I am at the school on Wednesday and will check the rootkit software + chkdsk.

[edutech4schools]

Chkdsk = passed

Memtest = passed

 

rootkit from above thread = 50000+ potential rooted files. I tried to save the list but it crashed.

 

How many false positives should something like this come back with?

 

If I re-install OS any advice to stop this same rootkit finding its way back onto the laptop. Could it have come from an excel doc?

[Arthur]

Wow! That's a lot. It might be worth doing a scan using GMER and/or RootRepeal to see if they say the same?

[oxide54]

try booting from a windows PE cd and run a virus/ malware checker from that