Process running out of user's Doc&Settings\Windows directory

[cheer8923]

I've noticed a WINDOWS directory created under C:\Documents and Settings\Administrator. It contains the following files:

infile.upd
win.ctx
win.ini
system (empty directory).

Hijackthis is reporting smss.exe is running out of C:\Documents and Settings\Administrator\WINDOWS\system\smss.exe even though the file does not exits.

It also reports several services are running out of that directory (and files are missing).

I've used regedit to search for this C:\Documents and Settings\Administrator\WINDOWS but did not find anything in there.

Is there any problems? Is this a bug in Hijackthis or my server is really messed up?

Thanks!

 

[cmeagan656]

You may have to display both "hidden files and folders" and/or "protected operating system files" in order to see the files.

There is at least one trojan that produces a fake smss.exe process. This tells you how to differentiate between real and fake smss.exe processes.



Hope this helps.

Please help us help you. Read FAQ690-6594: How to ask the best questions and site policies before posting.

 

[Roadki11]

Not sure about the services but the directory structure is normal if the server is a terminal server.


RoadKi11

"This apparent fear reaction is typical, rather than try to solve technical problems technically, policy solutions are often chosen." - Fred Cohen

 

[cmeagan656]

I've never seen a C:\Documents and Settings\Administrator \WINDOWS\system\ folder on my terminal servers. The windows\system folder has always been in C:\WINDOWS\system.


Hope this helps.

Please help us help you. Read FAQ690-6594: How to ask the best questions and site policies before posting.