Adrian Wells
asked on
Tampered screenshots?
I have a folder of screenshots on my computer and everytime I go to look at said screenshots I find at least one of them modified. It's always either completely black or looks as of someone scribbled over it with a black paint tool. It sometimes shows in the propeties of the image that it has been modified and sometimes it doesn't. I'm wondering if this is some sort of virus? I've tried scanning each image with Web root but it never seems to pick up anything like malware. It's yet to modify any picture outside of my screenshot folder as well.
Thomas Zucker-Scharff
Are you sure those screenshots were okay to begin with? Some software, like trusteer rapport, have settings that need to be configured in order for any screenshots to be taken without appearing black.
ASKER
Yes, the screenshots were perfectly fine the last time I had looked at them. The screenshots themselves aren't completely black however, it's almost as if the background of the screenshot is made black but the forefront of the image is just darkened. Besides, I wouldn't think a software like that would modify the screenshots days after the screenshot had been taken.
what is the date created/modified dates? are they the same?
Have you tried taking the files to another computer? If they open fine, sounds more like. Performance issue. Try disabling AV
My guess is that one of your accounts on your computer has a weak password and someone is messing with you.
ASKER
One of the recent ones this happened to was created on July 16th and modified on August 19th.
I haven't tried taking the screenshots to another computer yet. I'll be sure to test that out when I'm given the chance.
If you mean someone is physically messing with my computer, that simply cannot be the case. I live alone and my laptop rarely ever leaves my room. However, I'll try checking Windows logs just in case.
I haven't tried taking the screenshots to another computer yet. I'll be sure to test that out when I'm given the chance.
If you mean someone is physically messing with my computer, that simply cannot be the case. I live alone and my laptop rarely ever leaves my room. However, I'll try checking Windows logs just in case.
You can setup NTFS auditing for that folder to see who modifies these files.
Step 1: https://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/audit_object_access.mspx?mfr=true
Step 2: https://docs.microsoft.com/en-us/windows/device-security/auditing/apply-a-basic-audit-policy-on-a-file-or-folder
Then try and modify such a file, open eventvwr.exe and look into the security log - you will be able to search it for the file name and find the action logged.
Step 1: https://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/audit_object_access.mspx?mfr=true
Step 2: https://docs.microsoft.com/en-us/windows/device-security/auditing/apply-a-basic-audit-policy-on-a-file-or-folder
Then try and modify such a file, open eventvwr.exe and look into the security log - you will be able to search it for the file name and find the action logged.
This question needs an answer!
Become an EE member today
7 DAY FREE TRIALMembers can start a 7-Day Free trial then enjoy unlimited access to the platform.
View membership options
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.