Disappearing .exes - only recently installed programs

[Koocha]

Hi

 

We've had our network running for about a year and a half now (Server 2003 / XP Pro) and have had no troubles until recently.

 

We've put 2 big bits of software on: Clicker 5 and the 2Simple collection.

 

They've been running fine until one day every exe from the Crick Software folder and every exe from the 2Simple Collection subfolders vanished.

 

The first I knew about it was when a shortcut said it couldn't find the exe.

 

I redeployed both packages and everything was find for a bit. Then they disappeared again. At the same time.

 

We gutted our ICT suite over the summer and reghosted everything and the same thing has happened again this week.

 

There's 30 workstations and a laptop that the teachers use in the suite, all in the same OU with the same GPOs applied, yet nothing has disappeared off the laptop so far.

 

The only difference software wise is that the laptop has AB Tutor Control teacher application on and the desktops have the client version. I've tried a computer in the suite without ABTC on it and it still happened, so I don't think it's that.

 

Does anyone have any ideas why it's just the recently installed apps and no other ones? Or even better, why it's happening in the first place?

 

Thanks

 

Tim

[mrtechsystems]

mmmm my guess would be to check the AV to see if it not blocking them or seening them as a threat

[Koocha]

mmmm my guess would be to check the AV to see if it not blocking them or seening them as a threat

 

Oh, that's the other thing (thanks!)

 

Over the summer we got rid of Symantec and installed Kaspersky.

 

The problem is still present...

[Geoff]

Yes my first bet is that your AV software has deleted/quarrentined them. Other possibilities are a File Restriction Policy blocking or Access Based Enumeration.

[Koocha]

Yes my first bet is that your AV software has deleted/quarrentined them. Other possibilities are a File Restriction Policy blocking or Access Based Enumeration.

 

Wouldn't a file restriction policy block it from the start? The exes are there for a few days, then they disappear.

 

AFAIK we haven't got Access Based Enumeration set up

[Newton]

Sophos AV can report the 2Simiple software as .exe's as a virus, supose other AVs might do the same

[Michael]

I agree, it most likely the AV software which is quarantining them. Another possibility is a real virus itself, but then again, why would it just delete these two exe's?

 

With Sophos (and other AV software), at server level you should be able to specify exceptions or exclusions. I too have seen 2simple software identified as a threat. Absolutely no idea why though.

[Koocha]

I agree, it most likely the AV software which is quarantining them. Another possibility is a real virus itself, but then again, why would it just delete these two exe's?

 

With Sophos (and other AV software), at server level you should be able to specify exceptions or exclusions. I too have seen 2simple software identified as a threat. Absolutely no idea why though.

 

It's not just those 2 exes...

 

There's 2 from the clicker 5 folder (clicker5.exe and dontnetfx.exe (or something like that)) and at least another 27 from the 2simple collection, all from subfolders. Every other file remains.

 

There's nothing in Kaspersky to say it's done anything with the exes either

[Michael]

Have you tried studying the event logs for unusual behaviour?

[DanielZ]

You're welcome to contact 2Simple support directly (020 8203 1781) and we'll try to help you with this problem