Hidden and system attribute randomly appearing on folders

8 Mar 2006 11:22 AM

Confused

We have several win2003 file servers that periodically change the Hidden and
System attribute on folders (first appeared 5 months ago). The user community
then complains that the files and folders are missing/deleted. Anti virus
software confirms a root kit is not present, seems to affect all win2003
servers, updates do not appear to have caused the problem or hold a possible
solution. Our interim solution has been to run the Attrib command line from
dos promt to correct the problem. Question is, wht is causing this and how do
we stop it?

8 Mar 2006 1:00 PM

Jerold Schulman

On Wed, 8 Mar 2006 03:22:27 -0800, Confused <Confu***@discussions.microsoft.com> wrote:

>We have several win2003 file servers that periodically change the Hidden and
>System attribute on folders (first appeared 5 months ago). The user community
>then complains that the files and folders are missing/deleted. Anti virus
>software confirms a root kit is not present, seems to affect all win2003
>servers, updates do not appear to have caused the problem or hold a possible
>solution. Our interim solution has been to run the Attrib command line from
>dos promt to correct the problem. Question is, wht is causing this and how do
>we stop it?

Turn on Auditing for Object Access on a folder that is affected.
http://support.microsoft.com?kbid=325898

Jerold Schulman
Windows Server MVP
JSI, Inc.
http://www.jsiinc.com
http://www.jsifaq.com

10 Mar 2006 1:11 PM

Confused

Yeap got the auditing on 'object access' event id 560.

However the only way to track down the culprit is to access each 560 event
and look for 'Set key value', I have circa 2000 entries to trawl through.

Need some method/utility that will make the process quicker; any ideas?

Show quoteHide quote

"Jerold Schulman" wrote:

> On Wed, 8 Mar 2006 03:22:27 -0800, Confused <Confu***@discussions.microsoft.com> wrote:
>
> >We have several win2003 file servers that periodically change the Hidden and
> >System attribute on folders (first appeared 5 months ago). The user community
> >then complains that the files and folders are missing/deleted. Anti virus
> >software confirms a root kit is not present, seems to affect all win2003
> >servers, updates do not appear to have caused the problem or hold a possible
> >solution. Our interim solution has been to run the Attrib command line from
> >dos promt to correct the problem. Question is, wht is causing this and how do
> >we stop it?
>
>
> Turn on Auditing for Object Access on a folder that is affected.
> http://support.microsoft.com?kbid=325898
>
> Jerold Schulman
> Windows Server MVP
> JSI, Inc.
> http://www.jsiinc.com
> http://www.jsifaq.com
>