-Reg- added to filenames

[DRPCNZ]

Hi All, strange one to me. Clients laptop Win 11 pro Office 365. Files all saved to Onedrive open exisiting file make changes when it gets save it usally get -Reg- added into file name each day these files get added another -Reg- so after 3 days you have filename-Reg-Reg-Reg-.xxx HOWEVER I can find files that have not been edited since May last year that have 14 -Reg- in the filename. The hair is starting to come out in the handful. Anyone able to shed some light. Cheers

 

[nlinecomputers]

Sounds like ransomware to me. Nuke and Pave.

 

[GTP]

+ 1 This ^ I've seen similar things.

 

[DRPCNZ]

Sounds like ransomware to me. Nuke and Pave.

Was my thoughts in the background

 

[DRPCNZ]

+ 1 This ^ I've seen similar things.

AND of course it has to be in OneDrive and that is his only copy. Hes in country until August then goes back to Aussie, so I have inherited him until then

 

[Computer Bloke]

AND of course it has to be in OneDrive and that is his only copy. Hes in country until August then goes back to Aussie, so I have inherited him until then

Just to cheer you up, if it's only the files in OneDrive that are being changed then the odds are that it's another machine connected to his account that's infected, not the one you have.

Nuke and Pave.

It's a good thought but if the machine @DRPCNZ has isn't infected then nuking and paving it will just add insult to injury.

 

[DRPCNZ]

ESET Online scanner found nothing on this machine

 

[DRPCNZ]

Just to cheer you up, if it's only the files in OneDrive that are being changed then the odds are that it's another machine connected to his account that's infected, not the one you have.



It's a good thought but if the machine @DRPCNZ has isn't infected then nuking and paving it will just add insult to injury.

He has ALL his file stored in OneDrive, nothing local. He DOESN'T THINK there is another machine on his account

 

[DRPCNZ]

Just checked his Microsoft account, no other devices linked to that account

 

[Computer Bloke]

no other devices linked to that account

Ever, or just right now?

Either way, the next step is to turn this machine off for a day or two while you watch what happens to his OneDrive files from one of your own known-uninfected machines. If nothing changes then it's likely that his laptop has an infection you can't find, but if his filenames continue to mutate then there's definitely something or someone else with access. (I'd put a small bet on housesitters using his home PC.)

You could also try disconnecting the laptop from the Internet and creating a few tasty-looking documents on it. If they change then it's a local problem.

 

[nlinecomputers]

If access to OneDrive is compromised then change passwords and enable MFA