Quirky Windows 2000 Server file share issue

[Hessac]

I have talked to a lot of people in the business, that have never seen this issue.

I have a Domain Controller that is a Windows 2000 SP4 (currently patched (as much as a 2K server can be)File Server with a main Share, call it Data. Beneath Data there are 15 or so subfolders.

So:

Data
1
2
3
4
...

What is happening is randomly some of the folders under data are being flagged as hidden and system through attributes.

I can manually remove the Read Only check mark on the folder properties, and then attrib -s -h -a /s /d and this will remove the rest of the attributes, but the come back fast enough to see the folder go from normal back to hidden and system again.

Sysinternals could not tell me what is changing attributes. Nobody I have talked to has heard of this or seen it before. I have done multiple virus sweeps, including manually checking known reg keys and locations of bugs. I have found no evidence that points to a virus.

If anyone has experienced this, and especially if you solved the problem, I would love to hear how.

Thanks,

Aaron

 

[technome]

Rootkit maybe...

http://www.antirootkit.com/software/index.htm

Process Explorer, Autoruns may help

http://technet.microsoft.com/en-us/sysinternals/bb545027.aspx

........................................
Chernobyl disaster..a must see pictorial

http://www.kiddofspeed.com/default.htm

 

[Hessac]

I tried Sysinternals, unfortunately is does not provide info for apps touching the attributes.

I do not think I have run an anti rootkit so I will try that now.

Thank you,

Aaron

 

[technome]

Try multiple rootkit programs, just one does not catch everything.
What happens to the attribs if you boot to safe mode?


........................................
Chernobyl disaster..a must see pictorial

http://www.kiddofspeed.com/default.htm

 

[Hessac]

Server is in Mexico, I can reboot it, but I can't throw it into safemode from my desk. But, I can probably schedule the local guy to be available to do so. This is driving me nuts.

Thank you,

Aaron

 

[itsp1965]

By chance does the server have any 3rd party encryption software installed like Axcrypt. I would check the services applet to see if you have any 3rd party services running.

 

[GrimR]

sounds like a virus, I had the same thing on all my clerks memory sticks.
Does your hidden files and folders option work or does it keep changing back? Google "explorer show hidden file and folder"

BTW why manually remove Read only just add it to the attrib statement attrib -r -s -h -a /s /d

MCITP:EA/SA, MCSE, MCSA, MCDBA, MCTS, MCP+I, MCP