Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have some virus files being randomly created on root of a c: disk of one of my servers. How can I find out what created it? Some 3rd party software maybe?

share|improve this question
add comment

5 Answers 5

Have a look at the "Owner" tab under the "Advanced" properties of the "Security" properties page of the file's properties sheet. Odds are good, though, that you're going to see "Administrators" as the owner (which won't be too helpful).

The auditing functionality in Windows can help with this kind of thing, but it generates such large volumes of seemingly useless data that it's, practically speaking, not worth it.

share|improve this answer
    
owner is Guest! :) i don't know how that guest thing had missed my attention! Now i know some other computer from the network is "bombing" my server. Thanks! –  Boris Vezmar Jun 5 '09 at 17:30
    
Better the that Guest account locked down and verify that they haven't done nasty things to your machine. If they're creating files in the root directory you may have a serious mess on your hands. –  Evan Anderson Jun 5 '09 at 17:49
    
they pushed conficker virus into my server, but it couldn't spread anywhere else. i found all the remainings of conficker and removed it all. thanks –  Boris Vezmar Jun 8 '09 at 16:54
add comment

Let's assume for a second that what ever is creating these files isn't malicious:

  • You can look at the owner to see what user created the files
  • Then use something like Sysinternals Process Explorer to view the processes that are running under that user (Right Click the columns and check "User Name" on the "Process Image" tab
  • Then look at the handles that each of these processes has (Goto View Menu, Check "Show Low Pane, Change "Lower Pane View" to "Handles"), one of them may have a handle open to the weird files you're seeing

However, if whatever is creating these files is malicious it will take steps to thwart you. (File hiding, process hiding, obfuscation, etc.)

You can use some of the utilities here to check for rootkits: http://serverfault.com/questions/6149/a-list-of-windows-rootkit-detection-and-removal-tools

But if it the server has been owned, you know it's been owned, and you don't know how they got in: It's time to start rebuilding it and activating any incident response plan you may have.

share|improve this answer
    
Yeah, your answer is kinda next logical step after what Evan Anderson suggested, and it's the solution for this case! –  Boris Vezmar Jun 8 '09 at 15:55
    
Thanks, sorry to hear you had to rebuild. Cheers! –  Bob Jun 8 '09 at 20:04
add comment

You could also utilize FileMon for Windows, to log the Time and Process the file write was committed. Once you do that, track down the process using nestat -ao and look for the PID of the process that wrote the file. From here find the IP Address that is making the connection to your server and continue the investigation or DENY the connection if you are using Windows Built-in Firewall.

Link to FileMon for Windows: http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx

share|improve this answer
add comment

PA File Sight could help you there. You can set up a monitor to watch file creates in C:\ The app can log the creation time, the process used (assuming it's a local process) and the account used. It can log that data to a log file, database, and/or alert you in real time.

It's a commercial product, but has a fully-functional 30 day trial that would work for you.

Full disclosure: I work for the company that created PA File Sight.

share|improve this answer
    
HMMM, very interesting software! I'll give it a try :) –  Boris Vezmar Jun 8 '09 at 16:20
add comment

a bit more details would help; Windows version, name of file(s), text or binary? Can they be renamed/deleted or are they locked in use? Many times this will point to what ligit program added the file. You can run strings.exe and look for clues if its a binary file.

If its an NTFS drive, you can check the security tab and under advanced/owner, to see who created. Process explorer from sysinternals.com will also give clues.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.