you have a worm infection on your network server and or client pcs. this worm hides your original folders by changing its attributes. the first thing you need to do as scan your entire server , especially the shares. there have been reports that antiviral software don't pick up the infection. out of my own experience i have found that Microsoft security essentials does a good job of cleaning the infection. once cleaned you will have to delete all the exe folders on your drives, and then change all the attributes of the drives, to show the hidden folders. in a personal capacity this works best , on a company server i would suggest that you install a script to do the manual labour for you as this can be a time consuming project. the following script seems to do the trick , an edit needs to be done on the path and drive locations though.
- Install, update your antivirus application. I used Symantec and it found w32.sillyfdc
- Delete all detected files. The .exe folder just removed. Now you need to do is show the original folders
- Open File Manager
- Go to top menu, Tools > Folder Options. Select View tab
- Mark the “Show hidden files and folders.”
- Go to Start > Run, type cmd at the OPEN: box, and press OK. This will show the DOS command prompt
- Using My Computer, view the drive of hidden folders
- Go to Command Prompt and type this to unhide all folders and files:
attrib e:*.* /d /s -h -r -s
Where “e” is the drive where hidden folders resides
That should do it.
a sample of the script follows below.
attrib -s -h -r autorun.inf
attrib +s +h +r autorun.inf
attrib -s -h -r RECYCLER
rd /s RECYCLER
copy /y NUL RECYCLER
attrib +s +h +r RECYCLER
cacls /P autorun.inf everyone:N
cacls /P RECYCLER everyone:N