strange hugh rar files on root of c:\

**HipHoper** · January 4th, 2009, 06:31 AM

This client called me that his server notifies on low disk space.
On my remote ispection I saw 4 files named something like __080rar.019.
One of them was 22gb in size, the other one was 11 and two small ones.
I made a batch file about few weeks ago that rars files in drive G: to external connected usb drives.The total size of the backup is 10gb. I have no idea why these files are there and what is there source. Any idea ?
p.s. - their dates were few days apart from another, And I think even before I made the batch file
p.s. 2 - last week express sql 2005 server was installed on this server

**NooNoo** · January 4th, 2009, 06:46 AM

Oh you mean HUGE! I was wondering who Hugh was!!

Have you used winrar to look at the contents? The number at the end says it's part of a RAR that has been split up. Anyone using torrent or anything like that?

**HipHoper** · January 4th, 2009, 06:49 AM

No as far as i know regarding torrent or file sharing. Also, This files didn't have rar or similiar extensions. Just deleted them and will monitor in a few days to see if they re-occur, is so, Will try to backup files to external drive in another way like xcopy or such, Since it is only one big file (acron!s image) that is being backed up.

**NooNoo** · January 4th, 2009, 06:53 AM

On rars that have been split into a number of smaller files, you will get numbers as the file extension. Try it - get a big file and tell winrar to chop it up into say 1k blocks and it will.

**HipHoper** · January 4th, 2009, 06:55 AM

Yes, I get it Noo, That thing is that it makes just 1 big file and not splitted archive. What bothers is also the numbers (190), Which means it was splitted to huge amount of files......
Since the days were few days apart (Last one on december 31), I'll peek at it in about 10 days time - Unless client calls sooner :O)
Any suggestion for some graphic xcopy GUI for winxp ?

**NooNoo** · January 4th, 2009, 07:01 AM

Why do you need a grahical front end? What OS is the server running?
If the files are in use, this is no good

**HipHoper** · January 4th, 2009, 07:11 AM

The image file is created at night and is not at use.
I don't NEED the gui, But if I'll need to replace the winrar backup to xcopy, It would be nice to see the perecentage of the copy process instead of waiting for the DOS window to disappear...

**NooNoo** · January 4th, 2009, 07:23 AM

Then robocopy with or without the gui should do fine.

**HipHoper** · January 4th, 2009, 07:32 AM

The robocopy GUI seems to be useless. Will use xcopy or robocop by themselves.
Thanks Noo

**Matridom** · January 4th, 2009, 08:47 AM

is it possible that the computer has been hacked for whatever reason and is being used as a file server to host content?

**HipHoper** · January 4th, 2009, 08:55 AM

Oh my gosh...Never thought about a possibility like that, but I guess not, Since it is behind Sbox.

**Gabriel** · January 4th, 2009, 11:33 AM

Originally Posted by HipHoper

Oh my gosh...Never thought about a possibility like that, but I guess not, Since it is behind Sbox.

Sbox is not bulletproof - nothing is
Try to see if you can detect the owner of the file (file creator attribute).
Also you can always do auditin on the root folder to see who (or what) is creating the files - either from the os or using external application like http://www.softpedia.com/get/System/...le-Audit.shtml

cheers,
Gabriel

**HipHoper** · January 4th, 2009, 12:42 PM

Thanks Gab.

I've deleted the files, So will need to check again i n a few days if this reoccur, And if yes, Will need to check after I'll replace the winrar batch file.

By the way, Offered you the Avision scanner few days ago, Since I haven't got any scsi card.

H.

**HipHoper** · January 5th, 2009, 03:02 AM

Ok. Problem re-occured this morning with a huge 20gb rar file....
Deleted the big files, And converted the batch file to do a simple xcopy to the external drive.
Client also complained that the rar backup slowed the machine, So I guess Xcopy will run lightlier.....