Where are these files coming from?

[Bill Nicholson]

Win 2K server O/S...

Norton regularly finds viruses in files contained in this folder, according
to the Server Application Event Log:

F:\SHARDATA\2003\GlobalSCAPE\GlobalSCAPE\CuteFTP Pro\CodeSnippets\

However, there is no Cute Ftp Pro\CodeSnippets folder. The other part of the
path does exist. I turned on Viewing of hidden files and the files and the
path still do not show up.

The files appear to be file-sharing type files based on their names. We run
Norton on all our workstations but someone seems to be infected with
something. I'm stumped.



Any thoughts?



Thanks,

Bill Nicholson

Cincinnati, OH USA

 

[TisMe]

Bill Nicholson wrote:
: Win 2K server O/S...
:
: Norton regularly finds viruses in files contained in this folder,
: according to the Server Application Event Log:
:
: F:\SHARDATA\2003\GlobalSCAPE\GlobalSCAPE\CuteFTP Pro\CodeSnippets\
:
: However, there is no Cute Ftp Pro\CodeSnippets folder. The other part
: of the path does exist. I turned on Viewing of hidden files and the
: files and the path still do not show up.
:
: The files appear to be file-sharing type files based on their names.
: We run Norton on all our workstations but someone seems to be
: infected with something. I'm stumped.
:
:
:
: Any thoughts?
:
:
:
: Thanks,
:
: Bill Nicholson
:
: Cincinnati, OH USA


Ask around if anyone is using a ftp software. A good guess is someone has a
website. GlobalSCAPE is Cuteftp. Are you running a website? Certain
services or apps you don't need still on? I would start there if you want
to narrow it down. I would check for spyware too. Norton doesn't check for
some types of spyware. Or find out what you have exactly on your
workstations. It seems that something is running that shouldn't be. It
could of been downloaded some time ago and used for a website, but never
disabled or partially disabled on the workstation after they didn't need it
anymore. Ask around it wouldn't hurt. I have seen this before happen. One
person ran a hostserver for a while, but didn't disable it after they ran a
test run. It ran for months before someone realized what was going on. But
then again someone might be running something and putting all of your
workstations at risk. Ask around. Filesharing could mean someone found out
they had them a new storage area!