-Reg- added to filenames

[DRPCNZ]

Hi All, strange one to me. Clients laptop Win 11 pro Office 365. Files all saved to Onedrive open exisiting file make changes when it gets save it usally get -Reg- added into file name each day these files get added another -Reg- so after 3 days you have filename-Reg-Reg-Reg-.xxx HOWEVER I can find files that have not been edited since May last year that have 14 -Reg- in the filename. The hair is starting to come out in the handful. Anyone able to shed some light. Cheers

 

[nlinecomputers]

Sounds like ransomware to me. Nuke and Pave.

 

[GTP]

+ 1 This ^ I've seen similar things.

 

[DRPCNZ]

Sounds like ransomware to me. Nuke and Pave.

Was my thoughts in the background

 

[DRPCNZ]

+ 1 This ^ I've seen similar things.

AND of course it has to be in OneDrive and that is his only copy. Hes in country until August then goes back to Aussie, so I have inherited him until then

 

[DRPCNZ]

ESET Online scanner found nothing on this machine

 

[DRPCNZ]

Just to cheer you up, if it's only the files in OneDrive that are being changed then the odds are that it's another machine connected to his account that's infected, not the one you have.



It's a good thought but if the machine @DRPCNZ has isn't infected then nuking and paving it will just add insult to injury.

He has ALL his file stored in OneDrive, nothing local. He DOESN'T THINK there is another machine on his account

 

[DRPCNZ]

Just checked his Microsoft account, no other devices linked to that account

 

[nlinecomputers]

If access to OneDrive is compromised then change passwords and enable MFA