Virus or what?

[dr24]

I recently serviced a 6 PC network system that 3 of them had been possibly hit by something I thought might be a virus. In these 3 computers, a folder named Computer Programs was created and folders were being moved into Computer Programs. Of course all the icons and links were dead. Almost everything on the root directory was being moved into the new Computer Programs folder. All 3 of these PCs were affected at the same time and affected in the same manner. One of them was affected more and ended up with a scrambled FAT table. The other two were recovered by simply moving all the folders back to the root directory where they belonged and deleting the new Computer Programs folder. My only thought is maybe a virus could do this and get away without windows complaining about it. Anyone know what could have caused this? If it makes any difference, the user was transfering files from one PC to another PC on the network when this happened. I checked the tape backup to be sure that the Computer Programs folder did not exist prior to the situation. No virus was found anywhere on the system after this incident. The business owner feels that if I could not find a virus, that either the user or I caused this problem.

Does anyone know or have an idea what caused this? <IMG SRC="smilies/smile.gif" border="0"> [email protected]

[pcbwizz]

I'm not sure it was a virus. It might have been something in the transfer software the user used, or even using the software incorrectly. It can also be a Network glitch (after all, if you're using Window$, you already know about erratic stuff happening). To me it sounds like incorrect usage of the file transfer software.
Of course, running Norton AV to keep your health in better condition wouldn't hurt.
<IMG SRC="smilies/smile.gif" border="0">

[TeddyRuxspin]

The type of behavour you are describing does sound very much like a VBS virus. Remember that unless the virus software labs get the virus themsleve they wont have a scan for it.
I implemented 3 levels of protection for this reason so that at any time we have 2 scans of files. Norton, Sophos and F-Prot have all have Viri that they did not detect but the others did.

What scanner did you use?

[dr24]

Originally posted by TeddyRuxspin:
<STRONG>The type of behavour you are describing does sound very much like a VBS virus. Remember that unless the virus software labs get the virus themsleve they wont have a scan for it.
I implemented 3 levels of protection for this reason so that at any time we have 2 scans of files. Norton, Sophos and F-Prot have all have Viri that they did not detect but the others did.

What scanner did you use?</STRONG>

They had none prior to this incident. I installed NAV 2001 and updated it before I ran a full network scan of every file...not just program files. Nothing turned up anywhere. He uses an AOL connection and I know NAV doesn't work with the email portion of AOL. Most of the PCs I work on that have a virus or multiple viruses also have an AOL connection.

[dr24]

Originally posted by PCB_Wizz:
<STRONG>I'm not sure it was a virus. It might have been something in the transfer software the user used, or even using the software incorrectly. It can also be a Network glitch (after all, if you're using Window$, you already know about erratic stuff happening). To me it sounds like incorrect usage of the file transfer software.
Of course, running Norton AV to keep your health in better condition wouldn't hurt.
<IMG SRC="smilies/smile.gif" border="0"></STRONG>

I had considered a network glitch at first myself but I couldn't see how it perfectly created the Computer Programs folder on three computers. I've seen such glitches create bad folders like DIR00000 and such, but never a perfectly spelled folder. She was using Windows Explorer to do the transferring. She would grab a bunch of files from an old PC and move them to hers, convert them, and then transfer them to the new PC. Those three PCs were the only ones affected. The middle PC (hers) was the one that ended up with a scrambled FAT.

[Linthade]

Sounds like nothing more than IUV - Idiot User Virus. I'm always going on calls where ppl copy something to the wrong place, or think something is ok to move and just move it w/out thought.

Sounds like someone was trying to organize the programs they use into one folder and thought that the folders themselves needed drug into the Start menu to work.

[Divadrummer]

My question to you is...what new software was installed on these comptuers imediately prior to this happening? I cant begin to tell you how many times I've installed a program or some shareware that decided it was my new best friend, and put "My Pictures," "Software," "Cool Links" all over my computer.

Also, from what you're describing here, if this is a script, it's not a script that only executed once. This would tend to indicate that there is some program involved here. If you're truly concerned that this is a virus, you can manually check your system. In Win 9x computers, check out these places:

* Run= line in win.ini (there should not be anything here at all.)
* shell= line in system.ini (should only read explorer.)
* autoexec.bat (what weird programs are loading from here?)
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr ent Verstion\Run (and run Services.) These are all places where viruses like to load so they start every time Windows does.

If you don't find anything suspicious, chances are, this is just another stupid program that is poorly written.