some of my files disappear when browing network

[almegaAkil]

some of my files disappear when browsing the network...

It doesn't matter if I map a drive or not.

The files are still on the file server but they disappear intermittently...

I have no idea what is it...

It isn't a connection problem or a virus problem

I have scanned repeatedly for viruses

can anyone help me????

 

[Tezzie]

Your not alone, I have had this problem for some time, usually xls files disappear. Hope someone finds an answer soon

Tez

Women are like computers, you have to press a button to turn them on.

 

[bcastner]

http://support.microsoft.com/default.aspx?scid=kb;en-us;814112

 

[3142]

Maybe you should release more memory for the programs. Or one way is to add more cache for the main browser.

 

[Tezzie]

Thanks for the link, but been there before. Here's an edited event log from the server which shows the problem I have. There was in total 19 files which got deleted within 3 seconds of each other, and not all from the same directory.



05/09/2003 11:44:03 Security Success Audit Object Access 560 xxxxxxxxx\IAF xxxxxxxxx "Object Open:

Object Server: Security
Object Type: File
Object Name: \Device\HarddiskDmVolumes\PhysicalDmVolumes\BlockVolume1\TECH\Pol\Val03\Actives\ValActivesOngoing.xls

New Handle ID: 1944
Operation ID: {0,233827140}
Process ID: 8
Primary User Name: xxxxxxxxx$
Primary Domain: xxxxxxxxx
Primary Logon ID: (0x0,0x3E7)
Client User Name: IAF
Client Domain: xxxxxxxxx
Client Logon ID: (0x0,0xDD28AA4)
Accesses DELETE

Privileges -
"
05/09/2003 11:43:50 Security Success Audit Object Access 562 NT AUTHORITY\SYSTEM xxxxxxxxx "Handle Closed:

Object Server: Security
Handle ID: 1360
Process ID: 8
"
05/09/2003 11:43:50 Security Success Audit Object Access 564 NT AUTHORITY\SYSTEM xxxxxxxxx "Object Deleted:

Object Server: Security
Handle ID: 1360
Process ID: 8
"
05/09/2003 11:43:50 Security Success Audit Object Access 560 xxxxxxxxx\IAF xxxxxxxxx "Object Open:

Object Server: Security
Object Type: File
Object Name: \Device\HarddiskDmVolumes\PhysicalDmVolumes\BlockVolume1\TECH\Pol\Val03\Pensioners
New Handle ID: 1360
Operation ID: {0,233826009}
Process ID: 8
Primary User Name: xxxxxxxxx$
Primary Domain: xxxxxxxxx
Primary Logon ID: (0x0,0x3E7)
Client User Name: IAF
Client Domain: xxxxxxxxxx
Client Logon ID: (0x0,0xDD28AA4)
Accesses DELETE





Sophos is installed, and the drive is a raided SCSI drive. Offline files have been disabled, xp sp1 / server sp4 installed.


Tez

Women are like computers, you have to press a button to turn them on.

 

[bcastner]

Almegakil's issue and Tez's issue are different.

Alega's issue looks like an SMB signing issue, possibly a opportunistic locking issue. The earlier link suggests how to deal with SMB issues. For opportunistic locking problems,cf.

http://support.microsoft.com/?id=811492

and also see:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;296264asp&NoWebContent=1

What happens when opportunistic locking fails to release properly is the files will appear on subsequent browses as if they are no longer in the servcer directory, although they are in fact still there. This is exactly the issue raised by Alega and sorting SMB and op locks wll resolve the issue, as will two other things in my experience:

. Apply SP4 to the server. There are three fixes for exactly this issue on Win2k server;
. Disable the WebClient service on the XP machine.

In Tez's issue a client is requesting actual file deletions. There is not enough information from the server log to make this action appear as anything other than a legitimate request by the client. A block of file deletions could easily occure with an application that opens and closes temporary files; it can also be a normal sequence if the autodisconnect timer setting is not appropriately set on the server:

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q138365

Again, without greater detail on the files involved I am at a loss to say anything more. If you suspect a malware or rogue application is causing deletions by a client, I would run at least two on-line antivirus scanners from the client workstation. Try Trend Housecall and one other (obviously not Sophos) from smah's FAQ: faq760-3862

 

[Tezzie]

The file deletes have been happening ever since xp was installed on the network - easter 2002. We usually find it happening once every 4-6 months. This was the worst since it was so many files usually its one or two, so we put it down to accidental keyboard taps.

Because the delete files are never in the same folder it means that its not specific to any one member of staff, so changing AV as a test wouldn't be practical since we would need to install over the whole network.

Are there any settings / programs that could monitor a client pc for such activity? I have in the back of my mind a keystroke logger, but this seems a little extreme since it could be months before it happens again.

Tez

Women are like computers, you have to press a button to turn them on.

 

[bcastner]

Tez,

Are you using:

Oracle 9, or
Lotus Domino Server?

It looks as if you have some database application with a system java console doing housekeeping.

 

[bcastner]

Tezzie,

Before I forget, you would go absolutely insane having to review all the key logging logs on even a small network.

There just are not that many hours in a day.

But you can use Administrative Tools to follow which user has what shares open on your server.

 

[Tezzie]

Windows server 2000 sp4 with Exchange 2000 sp3

The person was in the pol folder at the time of the deletes.

We had a record locking issue some time back which the hotfixes cured, so im often in the 'shares' folder watching who's opening what - and before the fixes, often closing files.

Its a wierd one since there's no obvious signs, and if it was a bug, someone would have had it too.

Tez

Women are like computers, you have to press a button to turn them on.