I am having a bit of a trojan problem. We have a Windows 2003 Server configured with a partition for file sharing for backup purposes. In our network there are about 50+ computers with access to these folders. The problem is that each time the infected computers restart they write a hidden file and an executable (depends on the originator; eg: khw, vfixbi.exe) in each folder it has access network access. I think the hidden file is set with the exact date and time of writing but the executable is randomly dated. I desinfected a few but they keep popping up.
Is there a way to identify witch PC/IP is writing in those folders so i wouldn't have to go about and scan each computer on site/remotely.
Does windows have a built in tool, or can i install a certain software to track them down?
Thank you.