28000 folders appeared... 1

[Headmaster]

Hello

We set up a Linux/Samba fileserver as a PDC for a client. They called this morning to see why 28000 folders got created in one of the shares on the server. My first thought was a virus, but Norton thought differently when they scanned the machine.

Here's the variables:

-The computer that created all of the folders is an XP PRO box
-The folders are just random characters for names
-I guess their was about 28000 of them
-Nothing was in each folder

Has anybody seen this behavior before? A virus would explain this completely, but unfortunately I may not be able to blame this one on a virus. Always been my cop-out in the past!!

HA
Thanks for the replies
Scott

 

[xutopia]

it could still be a virus that has access to that drive, not the machine itself that would be infected. Otherwise no I have never encountered that before!

Gary

http://www.xutopia.com

Haran
==========================

 

[sleipnir214]

Could the spurious directories have been placed there by an unrelated means?

For example, does that server have an FTP server which allows anonymous FTP writing?

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[Headmaster]

xutopia: we scanned the client workstation for viruses and found none.

sleipnir214: The server is behind a firewall with no access available to any services. The owner of the files was the client machine mentioned above

What's the easiest way to remove these folders? Their was no unique pattern in the folder names to isolate so that a wildcard could be used. I had them use webmin's file manager, as any of the file managers in Winblows 'locked up.' (It's hard to explain the difference between waiting and locked up to some clients)

Thanks for your responses.

Scott

 

[danielhozac]

So the directories did also appear on the server? The reason I'm asking is that I had a similar problem once, but when I checked on the server, everything was like it used to be.

Is the creation time for all the directories the same? You could create a small shell script to remove them if they are.

//Daniel

 

[Headmaster]

I'll have to check. My customer may have already deleted them... If it happens again, I'll have to go on-site and take a look.

Thanks for your help!

 

[Headmaster]

I wanted to post this reply I got from the Samba group. Wondering if this rings any bells...

LeeMason wrote:

I have had exactly the same problem. About 28000 directories being created in a Samba shared area. They were in the format of a hex number (0-f) of various lengths (from 1 upward).

It has now happened twice.

The last directory created was one called "temp" with two subdirectories called "ext" with four numbers.

I think that this has been caused by a Windows XP service pack but have been unable to reproduce it under controller conditions yet. I will let you know if I managed to conclusively prove it.

Lee.