Windows 10 and magically hidden files.

[kaboom]

Re: Windows 10 and magically hidden files.

Windows 10 IS the Rootkit.

It's been the #1 mal/scam/spy/whatever ware over the last year or so.

Haven't we noticed that, unlike the past few "seasons," where there'd be a new flavor of "trash" making the rounds, all we have this time around is this abomination?

[Sparkey55]

Re: Windows 10 and magically hidden files.

Windows 10 IS the Rootkit.

[kaboom]

Re: Windows 10 and magically hidden files.

Why even bother? The odds won't be any different "just because" you happen to be working on that POS- you're a fool to think that...

[Spork Schivago]

Does anyone have access to a Windows 10 Home machine they can test something for me with?

I got one here. I'm trying to put Group Policy Editor on it. I found directions on how to do it. Anyways, I go to an elevated command prompt after running the setup program they gave me. I type:

cd \windows\SysWOW64\GroupPolicy
xcopy c:\windows\SysWOW64\GroupPolicy\adm /s /e c:\windows\system32\GroupPolicy

I messed up with the xcopy command. The command I typed should have put the files that are inside the adm directory inside the C:\windows\system32\GroupPolicy directory, not the C:\windows\system32\GroupPolicy\adm directory like I wanted. Now, this is where it gets weird...

While I'm in the c:\windows\SysWOW64 directory, this is what I type and see:

C:\Windows\SysWOW64>attrib \windows\system32\GroupPolicy\*
A      C:\windows\system32\GroupPolicy\conf.adm
A      C:\windows\system32\GroupPolicy\gpt.ini
A      C:\windows\system32\GroupPolicy\inetres.adm
A      C:\windows\system32\GroupPolicy\system.adm
A      C:\windows\system32\GroupPolicy\wmplayer.adm
A      C:\windows\system32\GroupPolicy\wuau.adm

Now, if I change directories to anything, this is what I get:

C:\Windows\SysWOW64>cd GroupPolicy

C:\Windows\SysWOW64\GroupPolicy>attrib \windows\system32\GroupPolicy\*
A      C:\windows\system32\GroupPolicy\gpt.ini

Here's the dir command...

C:\Windows\SysWOW64>dir \windows\system32\GroupPolicy\*
 Volume in drive C has no label.
 Volume Serial Number is 6C09-E3A7

 Directory of C:\windows\system32\GroupPolicy

06/27/2016 04:08 PM  <DIR>     .
06/27/2016 04:08 PM  <DIR>     ..
06/27/2016 03:57 PM  <DIR>     adm
06/27/2016 03:45 PM        128 gpt.ini
01/09/2016 05:24 PM  <DIR>     Machine
01/09/2016 05:24 PM  <DIR>     User
        1 File(s)      128 bytes
        5 Dir(s) 79,991,689,216 bytes free

C:\Windows>dir \windows\system32\GroupPolicy\*
 Volume in drive C has no label.
 Volume Serial Number is 6C09-E3A7

 Directory of C:\windows\system32\GroupPolicy

06/27/2016 04:08 PM  <DIR>     .
06/27/2016 04:08 PM  <DIR>     ..
06/27/2016 03:57 PM  <DIR>     adm
06/27/2016 03:45 PM        128 gpt.ini
01/09/2016 05:24 PM  <DIR>     Machine
01/09/2016 05:24 PM  <DIR>     User
        1 File(s)      128 bytes
        5 Dir(s) 79,991,689,216 bytes free

It gets even weirder. If I go into the c:\windows\system32\GroupPolicy directory, I can create a file like conf.adm....and whatever I put in that file, it'll stay once I save it. But if I go back to the c:\windows\SysWOW64\ directory and try opening c:\windows\system32\GroupPolicy\conf.adm, I get the original one that I xcopy'd.

Does anyone know what might be going on and how I can fix this? I was thinking maybe there was some sort of root kit installed but Norton doesn't find anything. I ran some rootkit detection program as well and that came back negative. I mean, I can run some other programs to test for infection, but at this point in time, I'd like to rule out yet another Windows 10 bug.

Can anyone test to see if they have the same issue? Thanks!