When i turned on my pc at the office this morning i found a file (text document) on my desktop saying that my secret santa salutes me and gave me a clue for where to find my gift. The weird thing was, when i opened the file details (using the file properties) i found that i was the owner of that file, 2 seconds later the file was deleted automatically. If we put the probability of that person being a system/windows admin aside, was my PC breached ?

My Pc is always locked when I'm not using it and No one has my password.

The hint given in that file was very helpful for me to find the gift so I'd say it was a friendly hack.

My main concern is, if someone can put files on my desktop (without accessing my pc using my username and password) then what's stopping him/her from viewing my files or even copying them.

  • 6
    But more important, what did secret santa say? What was the clue? Dec 11, 2013 at 14:31
  • 3
    There are a lot of details missing from the possible scenarios. Was your desktop locked, or could somebody have simply created the file as you? Could someone else have your password? What are the file permissions on that folder? Are there any sys-ops program running? Is there a task defined in Task Scheduler that could have deleted the file? Do you have split-personality syndrome? There are simply too many possibilities at this point.
    – AviD
    Dec 11, 2013 at 15:26
  • How did you "open the file details?" Did you run the file, or look at it in a file browser of some kind? What OS are you using?
    – GdD
    Dec 11, 2013 at 16:30
  • So did you find a gift at the designated location or not? If the gift was there, then it was a local hack which opens up a lot more possibilities for how the file got there. For example, booting from USB stick and putting the file on your hard drive, or even removing the hard drive and mounting it on another system.
    – Johnny
    Dec 12, 2013 at 1:48
  • @AviD my Pc is always locked when I'm not using it. No one has my password, no one will ever do. It was a text document. I sure do not have multiple personality disorder .. i guess. I will check the task scheduler; Dec 16, 2013 at 9:05

1 Answer 1


Anytime you find content that you didn't create and that looks dubious and unfamiliar, it's worth while to suspect a breach. Socially, when you think about it, even in a non-computer environment, Secret Santas are a bit of a security hack - hiding things in places that are yours (to some extent) and yet that you didn't give explicit permission to enter is a typical pattern in much of Secret Santa gift giving. The difference, at least in the real world, is that Secret Santa gifts are intentionally non-destructive, non-malicious and hopefully well intentioned if not beneficial.

When it comes to computers - if you aren't a forensics expert, it's pretty hard to tell what's happened to your system. Worse yet, doing a lot of research can destroy any evidence that would be useful if law enforcement is needed.

A self destructing file that appears saying something cute and social is generally a decently typical pattern for malicious software, so it's fair to be concerned.

So... for a next step:

  • can you think of an explainable case for someone to have been pranking you or being an honest Secret Santa? If so, talk to them an ask. These days, tampering with computers is a bit creepy and it's worth it to point that this isn't such a great way of delivering what was hopefully meant in the spirit of fun.

  • if you can't find or think of a friendly culprit - report the issue to whatever security group you have available - when in doubt, an IT help desk is a fine place to start, or an information security group. This is a do not pass go, do not mess with your computer type scenario - leaving your computer running, and untouched while asking for help is really the best approach - even for a semi technical user.

  • if this is a personal system, check into common hacks that match the behavior you've seen with google, and ponder the idea of well-reputed anti-virus software. Also, it may be worth a trip to tech support if you see odd behavior.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .