Question How to check if my google drive files have been compromised?

[pauly01]

Hi. Mentioned late last year my old dell xps 9550 which is my main laptop machine had some infections when i checked for viruses with microsoft defender. Used windows ten pro etc. Then removed those infections but i believe it might been a program where it isn't virus/malware and defender detected it as is. Because many programs are false positive as malware. But reason was because i had clicked on a link when browsing google and then it went to a website even though i didn't download anything. So when i did virus scan with microsoft defender, it showed something though that was a program that was already installed on my pc a while back as a threat. Then i bought kaspersky total and did all virus scan and it found nothing. But i still ended up doing a clean windows ten pro reinstall just in case. Now before i did the clean reinstall, i did recall several of my gmail accounts i was logged in at the time. Never saw anything weird though in the emails. Later on i recall i signed out the accounts but one gmail account, recall uploading some of my documents on the maybe compromised windows pc to its google drive. Did not want to save those files to a usb flash drive. Lets call this gmail account number 2. Gmail account number 1 is where i store all my important gmail account.



When i reinstalled windows ten pro on the dell xps 9550 laptop, i had to install driver and do all those things. Reinstalled kaspersky total as well. Now i have many important documents on my gmail number one account. So i would like to download many of those documents to my current windows pc. Now if my laptop had malware or keylogger or virus back when this happened, is there a way for the hacker to compromise my documents on google drive for that account without me noticing? The same important documents that i had on my dell laptop before i did the clean reinstall... i don't believe i saved any of these documents to a usb flash drive. Reason being i didn't want to infect say a usb flash drive with it. Now one important thing with documents or files or pictures uploaded on your google drive, is it shows the upload date on it. So for example if you had uploaded a certain file to your google drive account on say november 1 of last year, and say you might believe your pc might be compromised on around december, but you then did a clean reinstall of windows ten pro week or two later in december... if you go to your google drive account in that gmail account, assuming you see the same documents and the upload dates to be what you believe it was, then there is no way those documents could be compromised right? Example if a hacker wants to change your document by putting malware into any of your documents, you would then see the date to be another date instead of november 1 , is that correct? Such that it shows december, january or any newer date , then you know that person put something in that document or other documents so when you download it to your clean reinstalled windows laptop, you could get malware?



For the gmail number 2 account. Had saved certain files from my potentially compromised dell xps windows ten pro laptop and uploaded it to that gmail account. Had used kaspersky total to check for any malware on these documents and it show nothing. Those files are in the gmail number 2 account google drive. Would there be any risk downloading those files from my gmail number google drive 2 to my current dell xps windows ten pro laptop now?



My assumption is assuming the dates shown on those documents for my google drive 1 account looks correct, then there is no risk at any of those documents being compromised? i know everytime i override a current document on my windows pc... then upload it to the google drive cloud, it ask if i want to make new document and save old copy and i choose override etc. Then you see a new date on it. So someone that want to put something to that document or documents would make the date uploaded to change? But for gmail account 2, what about that?

 

[Ralston18]

If someone is really after you then they would be doing the same things to both gmail account 1 and gmail account 2.

And if AV and malware scans using different apps come up negative then all should be well.

= = = =

I noted another post by you with multiple questions about bitlocker.

Do you believe that you are a specific hacking target for some reason?

 

[pauly01]

When i did scan with windows defender after me clicking on a link, it showed i had threats but the threat that is shown was a program i installed a while back. But don't recall that program ever showing up as a threat a while back which is why i was concerned. And also recall didn't do a windows defender scan for a long time. So at the time i was concerned me clicking on a link could have caused malware/keylogger/trojan. So because of that, was concerned and then bought kaspersky total to scan and it found nothing but i wanted to be sure so i ended up just clean reinstall the windows pc etc.


The windows defender scan doesn't show threats right after that one time scan before i did the clean reinstall weeks later... but the issue was it kept showing a negative sign like -10,000 threats every so often or so after doing a windows defender scan which showed no threats so i was concerned about that. Also read its a glitch but for some reason, i could also never do an offline scan in windows defender anymore. Actually wasn't able to do a windows offline scan for at least a month before that situation. So would you say it was good idea to just clean reinstall based on that? Again kaspersky total found nothing but i read even the best AV can only find like 99.7%?


No i am not a specific hacking target. But i meant if say a hacker got malware or keylogger or trojan on my pc and could see my pc, i might would be a target. Does that make sense? So because of that, i wanted to make sure my computer was fully clean and doing a clean reinstall seem to be the only way. The thing was when i clicked on a link... it wasn't really a link. it was me searching google and you know how when you type something in, you see something like how do you make cakes? When you click on that, typically you see like a dropdown where you see an answer on google? Usually you see a bunch of questons right under each other? Well... instead of that... it opened a link to a website which i never expected. So imagine you click on that dropdown menu assuming it would have a sentence or two answering how do you make cakes... it directs you to a website. And that website im not sure if it is dangerous or not. Then right afterwards i did windows defender scan, i saw threats so that had me concerned though the thing that was showing up seem to be a program i installed a while back. But that program never showed as a threat so that had me concerned.

 

[pauly01]

So my concern was around that time, i was logged in both my gmail accounts. So if i got malware or keylogger or trojan, couldn't they just access my files and see everything im typing on my screen? But i didn't see any strange emails or anything like that.


But before i did clean reinstall, i had uploaded some important documents to my gmail google drive account 2. My concern is if my files got infected on my pc already... wouldn't those files i uploaded there be infected? Kaspersky showed nothing though. So im not sure about opening and downloading those files to my current clean reinstalled windows pc from that gmail google drive account 2.


But before any of this, i had uploaded many important documents to my gmail google drive account 1. There is no way any of those files could been compromised such as a hacker adding something to each file right... as long as the upload date it shows on the document would been the last time i uploaded it? Example say i uploaded 6 files to my gmail google drive account 1 on november 1. But for many months before that... every month or two i would upload an updated document of each document. So each time i do that... the date changes... does that make sense? So as long as the date of my documents in google drive never changed... its impossible for any documents to be compromised right? By that i mean they open my document up, put malware/keylogger/trojan in it, then upload it back to my gmail google drive account one? Because if they do that, i certainly will see the upload date for that is no longer november 1 correct? Want to download the documents in both of my gmail accounts google drive but how do i make sure its safe to? i mean there should be zero concern with gmail account 1 right? But gmail account 2, its possible? Do you scan it with kaspersky total before you open it? Do you need to scan it before you preview it? How do you do scan before previewing it?

 

[Alex Fare]

So my concern was around that time, i was logged in both my gmail accounts. So if i got malware or keylogger or trojan, couldn't they just access my files and see everything im typing on my screen? But i didn't see any strange emails or anything like that.


But before i did clean reinstall, i had uploaded some important documents to my gmail google drive account 2. My concern is if my files got infected on my pc already... wouldn't those files i uploaded there be infected? Kaspersky showed nothing though. So im not sure about opening and downloading those files to my current clean reinstalled windows pc from that gmail google drive account 2.


But before any of this, i had uploaded many important documents to my gmail google drive account 1. There is no way any of those files could been compromised such as a hacker adding something to each file right... as long as the upload date it shows on the document would been the last time i uploaded it? Example say i uploaded 6 files to my gmail google drive account 1 on november 1. But for many months before that... every month or two i would upload an updated document of each document. So each time i do that... the date changes... does that make sense? So as long as the date of my documents in google drive never changed... its impossible for any documents to be compromised right? By that i mean they open my document up, put malware/keylogger/trojan in it, then upload it back to my gmail google drive account one? Because if they do that, i certainly will see the upload date for that is no longer november 1 correct? Want to download the documents in both of my gmail accounts google drive but how do i make sure its safe to? i mean there should be zero concern with gmail account 1 right? But gmail account 2, its possible? Do you scan it with kaspersky total before you open it? Do you need to scan it before you preview it? How do you do scan before previewing it?

It is very unlikely. I wouldn't be concerned with your documents being infected. I mean it isn't a bad idea to scan them since it would take literally seconds for most files, Just to ease your mind. But it I wouldn't personally worry too much about it. I believe Google actually scans your Documents for viruses and as well as when you download them.

 

[Ralston18]

This:

"But for many months before that... every month or two i would upload an updated document of each document. So each time i do that... the date changes... "

I would expect an updated date/time (timestamp) for an updated document.

Such timestamps (along with other tools and methods) are critical to many document management systems. And often provide a full history of any given document.

One possible option is that you could keep copies of all documents on your own NAS or other storage location and then do a comparison with the corresponding document retrieved via gmail, Google, etc..

That would require some additional steps and specific methods to compare the documents for changes. Adding complexity and vulnerability....

Yes - scan the documents for viruses and malware. Google may be doing so - just to protect themselves perhaps more for their own protection than yours.....

I will not ask about or otherwise question the "importance" of the documents.

I will suggest that you consider what (if anything beyond viruses or malware) makes the document important in that some change in content really alters the meaning or purpose of the document.

If the documents are indeed that critical then you may need professional assistance to help secure management, handling, storage, and content.