Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am having a bit of a trojan problem. We have a Windows 2003 Server configured with a partition for file sharing for backup purposes. In our network there are about 50+ computers with access to these folders. The problem is that each time the infected computers restart they write a hidden file and an executable (depends on the originator; eg: khw, vfixbi.exe) in each folder it has access network access. I think the hidden file is set with the exact date and time of writing but the executable is randomly dated. I desinfected a few but they keep popping up.

Is there a way to identify witch PC/IP is writing in those folders so i wouldn't have to go about and scan each computer on site/remotely.

Does windows have a built in tool, or can i install a certain software to track them down?

Thank you.

share|improve this question
up vote 0 down vote accepted

if you right click on the file, and go to properties, look for the owner of the file. that should tell you what user account created it. Unless everybody uses the same account, that should do the trick.

share|improve this answer
Thank you. Didn't cross my mind. I'll give it a try. – Crishu Sep 20 '10 at 18:23

... I hate to say it... but you really should run AV software on EVERY machine connected to your network. You seem to have been lucky so far and have only run into a virus trying to self-propagate. Unfortunately, there is no way to determine which machine wrote the virus... but like Richard said, you can determine the owner of the file... assuming you require your users to log in using unique usernames. If this is a completely open share with no permissions or everyone is using the same username.... you've just stepped into a big pile of do-do.

Basic security principles should ALWAYS be used. All users connecting to your network should have unique usernames & passwords. And there should be NO shares that are open to the world & writable without a valid user logging in. Antivirus software in a windows environment is a MUST... (and a good idea in a *nix/mac environment too)

share|improve this answer
From my knowledge most of them have a free AV installed bee it AVG, Avira or MSE.(Other recomandations? with a corporate license?) They do have a user and password set for login, and to have access to folders from the shared file server they must enter it, but if it was set to 'remember' and the infection occured afterwards? The network is closed to interent access and uses a static IP, except a couple of unrestricted IPs and power users. – Crishu Sep 20 '10 at 18:29
If you have the $$ to spend... I highly recommend Sophos. It's FAASST and very low footprint. Sometimes it works too well however... It sometimes causes some applications to crash because it will delete the file while the program is trying to write it to disk. Still... you should be able to check the ownership of the file & narrow it down by-user... to where it's coming from. – TheCompWiz Sep 20 '10 at 21:11
How about Comodo Interent Security? I understand it's EULA also permits free commercial use. The firewall popus will be problem for some of the users but with proper tuning it may be an option.. Thank you for your recommendation; checked the price ~4000$ on a 3y 50 user sub .. sweeet :D – Crishu Sep 21 '10 at 5:57
He doesn't give enough information to draw those conclusions. @Crishu I'll second sophos, I used it on a small network and loved it, though I liked the central console best. IIRC it was around $50 / machine. Avast is good too. I'm mixed on Comodo, it seems to work better than symantec, but worse than avg/avast/sophos. – Richard June Sep 21 '10 at 12:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.