Question Advice on what happened to this PC

[jaged]

Logged into my mother's pc via Teamviewer b/c she was complaining about something that I wanted to look at. She tried to open a file with a program that she used all the time. The system was asking her what program she wanted to use and to search the Microsoft store for it. When I had a look around the programs, I couldn't find it. It almost seemed like the system had been reinstalled.
Strangely enough, Teamviewer was still installed & the shortcut was on the desktop.
I looked in her downloads folder and there were only a couple of things there from that day that I did. Everything else was gone & the same for Documents & Pictures.
I notice a Backups folder on her desktop so when I checked that, I saw the missing folders and what appeared to be the files as well.
While I can only assume her username/pc name before was something to do with her name, it is now Dell06xxx & it didn't show any account logged in. It just said it was the default admin account.
Actually I did find some shortcuts to supposed individual pictures. I didn't click on them & when I checked the properties of the shortcut, it pointed at Users/Dell06xxx/....../Dropbox/.... I'm going by memory & I didn't write down what it said. I left them there.
Has anyone heard of this before? Was someone in the system and messed around perhaps? I ran a basic Windows Defender virus scan and nothing was found.

Any advice would be greatly appreciated.

 

[Lutfij]

I ran a basic Windows Defender virus scan and nothing was found.
See if you can run malwarebytes to see what else might be on.

Might want to ask your mother and see if she let someone onto the system(yes I'm referring to those scammers) courtesy of TeamViewer.

I checked the properties of the shortcut, it pointed at Users/Dell06xxx/....../Dropbox/.... I'm going by memory & I didn't write down what it said. I left them there.
I had to work on a system that was hit with ransomware. Taking notes of file locations as well as their extensions are very valuable practice techniques. In fact you should be treading carefully with the system. I'd advise on reinstalling the OS, sterilize it since I've seen horror stories of system's being taken over.

 

[jaged]

I ran a basic Windows Defender virus scan and nothing was found.
See if you can run malwarebytes to see what else might be on.

Might want to ask your mother and see if she let someone onto the system(yes I'm referring to those scammers) courtesy of TeamViewer.

I checked the properties of the shortcut, it pointed at Users/Dell06xxx/....../Dropbox/.... I'm going by memory & I didn't write down what it said. I left them there.
I had to work on a system that was hit with ransomware. Taking notes of file locations as well as their extensions are very valuable practice techniques. In fact you should be treading carefully with the system. I'd advise on reinstalling the OS, sterilize it since I've seen horror stories of system's being taken over.

I ran malwarebytes and found nothing.
Checked her bank account and that's fine(just in case).
I'm going to change all of her passwords on my pc in case something is monitored(can't be too paranoid at this point).

Is it safe to upload her pictures to a storage site until we can get her PC reformatted?

 

[Lutfij]

You should be good to go. Run a double check with installed apps in the OS, i.e, Start>Control Panel>Uninstall a Program

I'm going to change all of her passwords on my pc in case something is monitored(can't be too paranoid at this point).
Might want to just keep any remote accessing app at bay, since that can be a gateway to other questionable folks.