Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite
1

We have had following problem on our Windows2003 server for weeks now, every day the folder on our share are being made hidden and replaced by .exe files with the same names as the original folders. I can "Un-hide" them and hide or remove the .exe "folders" but it keeps coming back within some hours. Windows is fully updated, we do a "thorough" virus scan (F-Prot) every night with no detections, and SpyBot S&D (recommended by F-Prot support tech) only detects 3 "Tracking cookies" which does not sound likely to hide folders.

We do have presence of "W32/Conficker" in the network which is not a very nice one, so of course cleaning clients is a high priority, but I don't know which is the more likely - that it is hiding on the server or keep coming from a client attaching to the Share.

Any advice is most appreciated!

share|improve this question
1  
Since this is happening to the share on the server, and the server appears to be clean, and you have malware infecting one or more of your client machines, logic would seem to point to a client (or clients) as the source of the problem. Have you scanned/cleaned every client machine? – joeqwerty Sep 19 '12 at 13:43
Well, we sure try to but I can not guarantee it. We continue to check clients. I have the feeling it resides in the server though, it happens too often, I doubt any infected client is that active. Same 15 folders are being changed like this every time it happens. – Otto Ardeby Sep 20 '12 at 17:34
Can you set the group permissions on the 15 folders so that the network PCs can't change them? Or can you turn on logging for one of the folders to see who is changing it? (I'm not sure how to do it but it must be possible!) – peter_mcc Oct 22 '12 at 13:10

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.