Jump to content

hacker deleted Pictures and Documents folder content in Windows 10

Recommended Posts

Hello, 2 days ago a hacker deleted entire content of Pictures and Document folder in my personal computer - I am also self business since more then 5years but I haven''t done nothing yet of my life, so it was game chars pictures, bills mine and family, 2 scans of my paintings not fantastic I had put on sale as images, and no idea what else was on my computer.

Reason why hacker hacked me was that I'm arguing with the fake job applies hacker company sends me in my email to force me going in dangerous places, hacker does phishing as fake persons (parents needing help on their children homework), as mafia (proposes me to use my bank account to keep so said rents of houses cheques), as fake ads (8 years ago was fake porn ads, but as they can't insult me no more on that, they try using personal information they stole by observing me through other people's computer so to prove me they can follow anyone and they know any complaint or private issue and put it in their ads so to block me psychologically to seek success in life, but as I have no life since lifetime, they are kinda out of information to ruin my life), as fake job ads and as fake schools and sometimes they imitate business and schools that truly exist. The IP they use is fake, headers are too long to complain, complain don't make them stop, they are limited in the foreign towns names they can choose to set their fake IP address, and most of the time as the email they prefer is the one linked to my Pole Emploi account, they insist, but it's fake and lie, they saw my curriculum at Pole Emploi website, but as self business I checked that it's not possible, as they select who can see the curriculums and as unlike hacker says if you set your address to be public, then it is public, so hackers says lies when they say in wrong french they are replying to Pole Emploi website job apply people as I tried to do the same and I don't have what they see. And hackers are millionaires as they can pay people from foreign countries phone call centrers to discuss with you about, for me was just fake school apply.

Crime took place the 24/02/2018 by 18h45 french time, although computer clock on Windows 10 can make some jumps of + or - 1 to 6 hours when it wants. And hacker knew I was getting out of home during one hour and that I had let computer opened and running in the internet.

I have a paid anti-virus, but not yet paid malwarebytes, none detected nothing (I supposed). Bluestacks virtual android machine with games did crash, but I could send the report from outside and they might have something. I already asked the world about it but most websites don't accept giving me support as I will maintain my war status against the hacker.

I installed TinyWall firewall since then, but I'm not in informatics and I am afraid of accepting if ever there is a malware or something as whitelist.

I have double boot Windows10 + Ubuntu Linux, I mostly use Windows because of video games. But I still don't have a job although I'm old and I can't pay all the security that exists on the internet to afford Windows security issues.

Files joined:

netstat –f > test_log.txt and ARP -a > arp24022018.txt done the  24/02/2018 at 22h30

And also Facebook that doesn't have nothing about that day, but a device I don't own Motorola Motor X did for sure connect on 12/02 14:01 and 26/01 19:35, although true Facebook never understood I don't live at Epernay, but could be a fake positive, as maybe 2 years ago I connected Airbnb to my sis phone, and no idea what trademark it was. I also used to share my games, but that was 2 years ago, not 2018, but Facebook don't tell years, so Facebook information is not clear.

Also have the 2nd Bluestacks report, I sent 2 to them, one automatically when games went slow the 24/02/2018 by 18h45 (I don't have this one) and another one I downloaded it maybe by 22h (the one I sent but might not contain the hacker footprints as the games were working correct, and no idea if the Virtual machine Bluestacks can watch the hacker inside Windows ?). I'll see if it's too big or not to join it ?

I'm sure there were plenty of files on images folders, because although I am trying to stop playing games, I did tones of pictures of my new Bluestacks games that I upload public in Facebook, and I save all of them at same place and they were not elsewhere, I searched manually and with Windows search. But no idea if there was personal pictures too in Images folder, as I was too much concentrated in game playing.

Another thing that blocked report was my online password manager but I did told them.

Each of my passwords are different and most of them are complicated when possible and when recent.

I need to be able to use Pictures and Documents folder in Windows 10 without fear, so please give me: ways of seeing hackers footprints, and ways of protecting me from delete folder attacks.

And I have a double boot Windows 10 + Ubuntu Linux, I can't use any program that could destroy Ubuntu Linux side as my Windows is OEM.


all my new bluestacks pics started after having been hacked 24 02 2018.PNG

bitwarden report also do not work 25 02 2018.PNG




facebook no idea who is motorola 25 02 2018.PNG

Link to post
Share on other sites

Hello, no not at all, no website gets my IP right, it has always been like this, I have 0 explanation, but maybe my internet FREE uses several places to get the unlimited internet cheaper alike bandwidth or RAM places ?
- I don't live near Epernay but I often get Epernay.
- Epernay is a city quite far away, we had visited Reims maybe 4 years ago, but we didn't went to Epernay. But France is small, it's not geographically connected to Ile-de-France, just maybe geologically as the center of France has sedimentary layers, but long time I don't read geology.
- I live at Colombes, but it's rare they put Colombes, except when there are internet incidents, even if I had not complain officially this one, when there are incident, all websites correct my location to Colombes.
- I don't have a Motorola Motor X neither a Samsung Galaxy Note 3, but I think my sis had a Motorola 2 years ago and now since 1 year a Samsung but she is working hole day till late and she can't catch home internet that far away, and I don't believe it was a Motor X neither a Galaxy Note 3 so 90% chances not to be her phone. She has no reason to sync whatever with my phone, but I do sync Bluestacks and I did sync Klipad tablet until it stopped working by 3 days ago, maybe static electricity issue by connecting to wire, that has weird relation with the fact that my Freebox had lost hours lamp diode, but the Freebox recovered the lights later.
- Ile-de-France is a general location that includes Colombes (92) and Paris (75) and other locations.
- The yahoo mail icon had dissapeared from mum's phone (that has not got same gmail account then me, I have 2 gmail accounts) - (my  sis don't have same gmail account neither), it was at the time crime did occur 2 days ago, also same issue in computer my Yahoo mail was not accessible but I closed Firefox and went out with mum, it was only turning round with an unlimited waiting arrow inside my computer in Firefox. I thought Yahoo Mail was having technical or financial issue.
- My actual phone is also a Samsung, but not a Galaxy Note 3, it looks more like the solid GT-B2710, but for sure it's an older model if not this one, and I can use Facebook with it. And my Klipad was 7588AN, I had added my Bluestacks gmail in it too as option to link the games, played about 2 times before it died, so I have 2 syncs to my main gmail account - and games must be sync from inside them at games parameters or profiles, not only from outside, so no idea if games sync from inside affects type of machinas ? Klipad was often re-installed from inside as I did not like it, no idea if that affected type of machina?
- No idea in what does Bluestacks Android virtual machine shows as in name and trademark ?
- Linux must be me as I have double boot Windows 10 / Ubuntu Linux.
- Now, my IP location gives Paris, Ile-de-France (FR) ? But I live near Paris at Colombes. No idea if my IP numbers inside my address do change with all these weird multiple locations from same place and not same time, as I did not follow it.

- I did secure 1/2 Facebook account the 25th, but I'm only showing you 1 of them. The other one I got my account back with no security as I just have 1 phone but I'll get myself the USB u2f key, and right now I'm not sharing no game in Facebook, I used to pilot, but I did share too few in past, but that was over 2 years ago.

- I don't use outlook mail, but only online Yahoo (always) and Gmail (not often, just now).

- Answers received by mail have got nothing to do with question, says to close programs that are slowing down Bluestacks and says does not understand question, from password manager, so no hacker footprints from outside world. Not sure hacker used my online accounts ?



I'll go have dinner, thanks for the time =)

facebook now 26 02 2018.PNG

facebook was securised on the 25th.PNG

yahoo security 26 02 2018.PNG

yelp 26 02 2018.PNG

google security 26 02 2018.PNG

Link to post
Share on other sites

This is my main account for all my passwords recover :'( but the mail spammed with phishing is not this one :/ it's the one linked to Pole Emploi website so that hacker says he read my curriculum in Pole Emploi website witch is not true as I verified I can't do what he does to myself as self business. So what does it means ?

I am subscribed for over 1000+ websites so it's impossible to change and I didn't finish saving my passwords. So does that mean I must change my center of password recovery to other mail not pwned ? It's going to be long work, and not sure all websites accept that change :/

Link to post
Share on other sites

Yahoo has been breached so many times that it's better to forget about it. Try to contact Yahoo to close your account.

Also, change all Your passwords for all sites You're using. Do that from a clean computer. (friends for example).

And look for help on Malware Removal section in this forum or ask administrator to move it there. :)


Link to post
Share on other sites

OK. I'll do this tomorrow (here is over 22h). I already use 3 anti-virus, one is paid.

But I have to put back my life first before the computer because what hacker wants is also ruin my life by eating my time and I did too much gaming lately and haven't done any work I should (lots of gaming + 2 years of gaming + more gaming = more then 6 years of gaming lost). I can't let myself worry that much. Just pity for the trouble I'll bring to all my linked websites :'( if ever. But could be just threaten as usual, and maybe nothing will happen ? Except maybe some delete. And surely also fake IP bans.

So I'll see what I'll do tomorrow and we'll see.

In conclusion I think Windows is better for cool programs use and nice experience, they don't accept but I feel there are virus in Linux too watching us. So there is no solution. I did panic but stay zen is best way. I can't change nothing, life is written and I'm not afraid.

You wrote something, I'll see it. I think I'll analyse it just for the fun of hoping to get a footprint, but I don't use 90% of my Windows 10 programs, and I did install lots of free games I did not test. I don't feel well in taking people's time like that.

And I must be loyal to my program partners =)

Link to post
Share on other sites

@ Bitwarden (and you too Malwarebytes forum)

Hello, I think I understood the trick, on Windows 10 the hacker can change my computer model Acer Aspire E1-530G into whatever it wants alike Smartphone Motorola Motor X or whatever it wants, and maybe it can change my IP too. So I suppose if I do create new mail boxes in Yahoo Mail, it doesn't want me back in as not same device for 2nd try, idem Facebook asks me often to add new device while I hadn't even close browser just did deconnexion not so long ago. That explains why it could ban my IP easy from anywhere, although it doesn't do it, and although those late times it did forgot to change device type of Pale Moon browser inside my Acer Aspire E1-530G, reason why I can ignore its banning.
I might change a few passwords but not all. I won't delete my w@y mail, because although I did nothing yet, it is my official self business mail, and if I want to change it, I'll have to pay the Commercial Register for it while the Hand made creators Register had just helped me nicely registering for 2euros instead of a big sum I don't have, as Self Businees into the Commercial Register as french laws wants the Self Business to be less and less different then the big business. So if I close w@y, I'll have to pay money I haven't got, because no job yet, to stay inside law. So it's not a mail I can afford to delete.

But I can create new mails and use whatever mail I want for any official or internet website Self Business, or social or private relations.
2nd thing is when I apply or had apply to something interesting in life, like now I will do a music event, and in the past I did photography and paleontology event. Those event mails you can't unsubscribe because they are private newsletters others outside from event can't subscribe. So they often send me mail for conference invitation or organising something, and I already tried but they don't understand the concept of: I did change mailbox. So I'll loose the few thing I did or I'll do in life if I close w@y .
That's it =)
I don't believe they went inside Bitwarden yet.
Edited by Waterreedshimmer
Link to post
Share on other sites

I'll add to you some pictures of my Windows from Ubuntu side, as I have double boot but I hadn't done nothing but getting out and getting back that day the Sat 24th. Maybe you'll get an idea (or no idea) of what happened. Home was empty when I had got out between about 18h45 and got back by around 20h30 according to the new 24th pictures. Game pictures are not important but there was tons of them from the 24th earlier and the days before. And there were other things on the computer but I don't remember what. Last time I did save everything was too long time ago to remember. Just today I saved everything from Windows but did not chmod nothing, so I just did copy save to external disk. But last time I used my external disk was too long ago and surely there was plenty of things in PICTURES and DOUMENTS folder. My Windows is in French, tomorrow I'll see if I can switch it to English as I switched this one from Brazilian (to train language) into English for taking some extra outside pictures for you. Windows don't seem to have been touched by hacker (could have been an update that did that too, but Windows did not show any update question), just these two folders. Today we are Tue 27th Feb 2018.

01 nothing to see taken 2018-02-27 17-29-37.png

02 nothing to see taken 2018-02-27 17-30-31.png

03 Documents was accessed saturday 24th taken 2018-02-27 17-31-53.png

04 Pictures folders since then taken 2018-02-27 17-37-26.png

what was used on 24th feb p01 taken 2018-02-27 17-53-13.png

what was used on 24th feb p02  taken 2018-02-27 17-54-38.png

what was used on 24th feb p03 taken 2018-02-27 17-56-09.png

what was used on 24th feb p04 taken 2018-02-27 17-58-02.png

what was used on 24th feb p05 taken 2018-02-27 18-01-09.png

what was used on 24th feb p06  taken 2018-02-27 18-02-48.png

what was used on 24th feb p07 taken 2018-02-27 18-04-07.png

what was used on 24th feb p08 taken 2018-02-27 18-04-57.png

what was used on 24th feb p09 taken 2018-02-27 18-08-17.png

when I came back home - no one at home - taken 2018-02-27 18-25-14.png

Link to post
Share on other sites

Anyone wants to check if there is a virus related to the fact that 2 of my folder content has disappeared in Windows 10 side  (hacker or update error or some weird thief observing me but I don't believe in this version) + the fact that a mail that I can't delete has been pwned (if I delete it, hacker could pretend to be me as it defines me in all internet address books as self business + as normal person, aka $$$ to change it officially and on non official address books, and he likes identity usurpation, so also dangerous for Paypal and mails) + the fact that I don't understand what is me in the social network security listing of connexions (so maybe something changes my Firefox into other device, or maybe the devices are just a conclusion of detection quality and other unknown not dangerous facts and interpretation) ?

If it was a hacker the fact that it deleted my folder while I was out, I was out during +- 1 hour, was meant to do fear, so it proves it's the hacker that sends the fake Pole Emploi job ads because I'm sure that he was the same that sent me in mobile phone when no 33700 existed in France, fake porn ads to comment me when I was out or doing something that I shouldn't like or shouldn't study further, so with or without internal computer camera, hacker can somehow know we are not at home, and play fear game on that. And the fake Pole Emploi job ads also may content suggestions of subliminal references to life incidents so that I think I shouldn't like or do whatever in life, basically hacker plays with the psychological: you shouldn't or they'll hate you or they'll think that of you and you should just try doing things in life that can't bring self estim. So it's all the same malicious poem be on phone, on game, on browser or on the web and in many text or non text format, they like a lot fake ads of any kind but they try other text types also. Internet doesn't bring much happiness to me. But I'll PK all of the hackers, one day and bring happiness to the world =)

Link to post
Share on other sites

Maybe Google (I didn't write to Google) is checking my Google Play account, as I can play my already installed games on Bluestacks but I cannot install new ones, typed my new password + code more then 10 times then it blocked (red message), then I unlocked with recovery code - code de secours + did put my firewall on learn mode (as it can block my printer also, but it wasn't firewall), then same problem again, is not recognizing phone codes, then I tried old password, then it said connexion problem with Google servers. Told Bluestacks about it, hope they'll confirm or reject if they are Motorola Motor X (but could be game, no ? as we also link games from inside them, and time and date correspond to game plays). Hope it's someone good checking it =)

At the end of multiple tries I got that message:

Google devices on today 02 03 2018 6th but blocked on Google Play.PNG

Link to post
Share on other sites

I just inscribe myself at: https://www.signal-spam.fr/

in the past I used the FBI to send the reports but no space to copy paste although very good that we can comment =)

Here we have space, we are not suppose to comment, but I will comment, it's not the same mail at all that was pwned and that is spammed and phished with orders to psychologically block me from life success. Maybe it's racism, no idea. Anyway it's weird. But we've good 2 weird in war here.

I'll go dinner then I'll vomit to them every spam phishing I had from hacker, sad we can't comment, but I will comment because from times to times the fake ads aim commenting me by proving the hacker company is watching me and my life somehow, although I am still no one, but not carrying about it anymore =) This year I replaced hate by love because of Saint Seiya, but that's not your point.

Firewall people say usually it's virus that deletes folders. But I don't know as I don't have fast startup activated in Windows as I can login , well walk in, from Ubuntu side. But even if it was too long ago that I logged in, I always let my chmod -R a+wxr (wow it was long time) on in folders, and it was off, so folders were chmod back to me me. That's easy to do in the inside to inside part, no idea in the outside to outside part, you don't need Windows password to log in Windows from inside neither to chmod, and I am same username in both sides Ubuntu and Windows, so if there was a hacker, I don't see why he would need to know my Windows password. So what I say is I did save with copy paste, but I usually have access to cut paste, not only to copy from inside. Plus there is the calendar date in the document folders. But right now I'm going to eat, bye =)

Link to post
Share on other sites

The one thing proof is that Documents folder had last change on Saturday 24th feb 17h25 fr time, even though I don't have good memory at all, I did not notice nothing 1 hour before getting out of home.

The one thing weird is no idea why I don't have cut option elsewhere in private Windows folders alike Video folder or in internal letter storage ? But nothing says the date 24th, so maybe there was a Windows update that chmoded my files automatically including internal letter storage ? Or I did notice nothing at all and was too much concentrated in games and it was changed long ago by hacker ? I have important documents in FTD internal storage letter and bank stuff (although I'm poor). Only System Volume Information of FTD was changed on the 24th at 14h26 PM. I don't remember to have sent a curriculum to apply to a job that day, I think I only played, so no idea on why only System Volume Information folder, not content has this calendar date ? Content seems OK in calendar dates, although I have no idea what it is the use because I don't try knowing that much about Windows.

My old chmod (unless Windows did an update and changed it without I notice, because I was playing games), was specific lifetime cut - paste - create new document - change document - execute on personal Windows folders and internal storage letters devices (not in hole Windows, I'm not crazy). So all my files can be used with no problem from boths heads of my computer. But I was not in thinking about files from long time. So I was expecting it to still be active today, but it's not, you can only copy, no cut, not create new file/folder. So maybe hacker, maybe Windows updated chmod options, no idea. Maybe hacker is a virus, no idea, but I say the word hacker because it's how I see things as a non professional. I'm still using my Windows so all that chmod thing is soon going to disappear.

Some interesting opinion is when external storage is new, at first although it's correctly chmoded (I'm not in maths), it usually bugs the same way because it's new, then later it works, go understand why ? So new devices don't like cut/create new file/folder, but if I remember new devices don't allow copy paste neither, so I don't think it's case.



FTD SVI content from 2018-03-02 21-44-26.png

FTD issue from 2018-03-02 21-39-26.png

videos is only copy paste also from 2018-03-02 21-27-13.png

Documents from 2018-03-02 21-25-14.png

FTD external disk from 2018-03-02 21-22-48.png

FTD internal storage from 2018-03-02 21-19-13.png

Link to post
Share on other sites

I know how to think. No connection with Google servers (Bluestacks) means, runtime error, means same error then in my website - the FAKE IP BAN I can solve by using non affected browser (if hacker didn't patch all of my browsers - and my hosting owner had agreed with me was not him that ever tried to ban me or anything), means same error then in my former game (their website was quite a gather for the hackers...), when players did cry: - I can't connect T.T although in Google Play I still can play my games, they are connected to chat and it's just the Google Play: install new game + pay option that is closed. What is weird is the wrong password, wrong phone code, wrong recovery code part, but this is due to no connection so maybe empty field is send ? I have to solve that, I have also NON premium Malwarebytes on Bluestacks, but no idea if no connection to Google Play servers virus was patched on Bluestacks side or outside in Windows 10 ?

Quite rare to have my powers, but I only mind detected brainwaves on the Pwned issue part of my problems, not on all this. Even if my interpretation is hacker, I cannot access to hackers mind,  so either it's lack of powers quality from me, either it's virus or there are other things that prevents me from sensing it, but I'm not a see in the crystal ball whatever, I don't detect brainwaves with will, I can't use will to use my powers, so I can only see small part of the door.

That was the support sent before Bluestacks told me error: no connection to Google servers, it was before I enter recovery password.


Google devices on today 02 03 2018 5th but blocked on Google Play.PNG

Google devices on today 02 03 2018 6th but blocked on Google Play.PNG

Google devices on today 02 03 2018 4th but blocked on Google Play.PNG

Link to post
Share on other sites

Facebook added new device (not new, oooooold) at my town Colombes, it is Colombes because I'm having an issue, else they (whoever) put Epinay location ...

And Google says my password was changed at La Garenne-Colombes witch is wrong as I live at Colombes. I know my new password right. Was surely wrong to change it as this play change my IP location thing from hacker or virus or phone company or whatever, could also explain, be a SECOND theory on why I have this fake IP ban on Google Play (aka can't connect to Google Play servers, aka thinks my password and phone codes and recovery code are wrong while they are right.) - It's rare I get La Garenne-Colombes as IP location although near me ?

So they always get things wrong...

This FEAR + CHANGE ALL YOUR PASSWORDS IS A TRAP. For enemy to play with your location recognition that can also block you. Also this QUIT MAIL IS A TRAP as if your mail is official on tons of address books online and offline can lead to identity steal, and hacker sends phishing only from my theory is: end points but limited in cities, hacked accounts, closed accounts that where re-opened with same name, so hackers likes abusing innocent people to put them as fault so that we persecute wrong person back. I didn't see much Batman,  but surely it's meaner then the Joker attaching innocents dressed like his team.

Then if it's not enemy and just security + security = security, I can't know truth.

I can't link pics (internet connexion issue - solved), but it's OK, I said what I meant. Glad I saved this post =)

Bluestacks issue 04 03 2018 why la garenne colombes.PNG

Facebook issue 04 03 2018 had put me back in Colombes.PNG

Facebook issue 04 03 2018.PNG

Facebook issue 04 03 2018 b.PNG

Link to post
Share on other sites

I didn't receive no Google notifications about wrong location, so still a mystery -_- but it says they (robot) can block you when wrong location and true password, I still will read my other mailbox, but usually they (robot) tells that on Gmail.

For the bank I told them as person and by mail, but I don't think it exists report paper for talking about we don't know if there was hacker or virus or update issue on computer and if it had read or not bank stuff. So what is not material cannot be reported (unless you're rich of course !) if there was no fraudulent action linked.

No idea if game is being sync or not, as Motorola Motor X use is not concomitant to game use today (was the days before and is neither concomitant to Bluestacks use, was the days before), so Maybe Motorola Motor X is Google Play Application only ?

Bluestacks issue 04 03 2018 b.PNG

Bluestacks issue 04 03 2018.PNG

Link to post
Share on other sites

I made a nice suggestion to Facebook, hope Google will FOLLOW (as it's impossible as human to solve this since robots often comes back together with us and make us accept to add new devices as being us so said for not to have to type again password, but we can reject robot entrance and not having to type it again and as each time you say it's not me to reject all the robots, you need create new password even if it's phone linked, so that means you can see the robots in Google and Facebook but not in Yahoo and in Forums and everywhere else and mostly private places like what the phishing enjoys reading and messing up, etc. --- and if you want to create a Firefox Add on to block robots that pretend to be us by login together with us, you're welcome =) ):

Hello, as it work to say do not remember new device+location so to stay in old device+location, and as SAME device may say WRONG devices and WRONG locations, please show device+location BEFORE we add it, will be a nice improvement, for us not to login together with robots that are NOT us, thanks =) ~ I'll post this suggestion ONLINE.



I would need you to show me my IP location and devicev to accept it.PNG

Facebook suggestion 2.PNG

Link to post
Share on other sites

Another day I'll have to get rid of the robot in Linux side, and getting rid of robots in both heads of my computer is going to be HELL, because you cannot guess when 1st new device is yours and not a nasty robot together with you :/ And I need the Windows head not to be reset if I find right or wrong robot in Linux side. That is valid for hole internet websites, millions, trillions of them.

Edited by Waterreedshimmer
Link to post
Share on other sites

This topic is now closed to further replies.

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.