All files on a share become hidden - anyone seen this?

[sidewinder]

Last week, at 2 seperate times on the same day, 2 shares had all the folders set to hidden, and a shortcut to every single folder/file created. Had to restore from backup in the end.

At first I thought it was something a staff member had done, as one of the shares was a public area which teachers can write to, but then it happened to another share that only I have access to.

 

In the end no big deal as all the data was still there, but slightly worried that if it happens to say, a user share, no-one will be able to see their files until I fix it. Just seems really weird. No viruses detected. All the other shares on the affected server were/are fine

 

Any ideas?

[JHLEHS]

Hello SideWinder,

 

This might well be a virus we have had the same thing to find out that symantec has found a trojan called the trojan.zbot. This done the same thing for us, it hides all folders on mapped drives and then creates shortcuts with a command to launch the shortcut.

 

I had a look on the symantec website and got the following information? This was a big deal for us and I suggest you scan all server immediately, we have documented and screenshoted the problems that we have had and reported it to RM.

 

Also look out for shortcuts to .exe and ive seen shortcuts for .doc and ppt!

 

This happend the same week! I seriousily reccommend you to run a virus scan on all servers and we have been hit by this and it spread pretty quick.

 

 

JHLEHS

Edited November 16, 2012 by JHLEHS

[JHLEHS]

http://www.symantec.com/security_response/writeup.jsp?docid=2010-011016-3514-99&tabid=2

Heres the the info from symantec.

[sidewinder]

Update on this, as nothing else went wrong, I forgot to check this thread, until it happened again this week.

 

And upon checking the shortcuts, they were launching a command of some sort - so I knew then it was a virus.

 

I've scanned the share with several tools and sure enough there were a few trojans there, but all cleaned up now. Just to be safe I've moved the share to a brand new VM

[JHLEHS]

Yes, what I think happens is that the command launches the same shortcuts put puts it in a command box and then runs a command. The above symantec document explains that when this is clicked the trojon trys to report information back to there servers. This grew to affect all our servers, which AV do you use symantec endpoint?

 

I would make sure all servers have the latest virus defintions installed and it might be worth sending an email to staff to not launch these shortcuts as that is how the problem for us replicated.

[sidewinder]

We use Sophos, will be setting a full scan over the weekend on all the other servers. Not had anything reported from clients yet. Then again I dont fully trust Sophos..

 

Shortcuts are all gone now, and luckily it was on a hidden apps share so no-one could click the things (I may have once, probably on the server, which has now been cleaned)

Dread to think what would have happened if it had affected the shared area...

Edited November 30, 2012 by sidewinder

[colacao82]

We've had the same thing. If you look at the security settings on the shortcut it tells you which user created them. Usually the user who downloaded / opened the virus.

[JHLEHS]

Yes indeed, report it to RM as they need to be made aware of it. It was nasty at our place. We had to reboot all our servers and scan them etc, it was a lovely weekend job... Not! When did you get it colacao82?

[colacao82]

Well I think we had it in November originally. But have had a couple of cases since!

[glennda]

Only thing that found this for me was kaspersky tds killer.

[colacao82]

We've got McAfee but it didn't seem to detect it! What's everyone else using?

[glennda]

We've got McAfee but it didn't seem to detect it! What's everyone else using?

 

Yup my client had this, i tried - Sophos command line scanner amongst other things along with a couple of others. All of which didn't detect until Kaspersky did.

[sister_annex]

My sister's USB Pen had this and the Symantec install didnt pick it up, plugged it into my win 7 virtual machine with MSE installed and it picked up the virus in seconds, sorted it out and all i had to do was run the attrib -h command on the drive to get the folder structure unhidden.

 

annoyingly, she put her pen back into her laptop and the infection returned :/

[JHLEHS]

Seems like it is a newish virus. We have symantec endpoint RM's adaption. McAfee always causes problems in my experience with end users. I really do not like McAfee as it really slows down computers. Symantec was able to detect it, the reason why we picked it up in the first place was because are definitions were not updated.

[sonofsanta]

Microsoft System Center Endpoint Protection picks this up as Backdoor:Win32/Caphaw.D!lnk and successfully removes it of its own accord. We're seeing it on pensticks here, though the virus gets neutered as soon as it's plugged in to a machine.

[mistersparky]

We have been struggling with this on and off for the last week or so. The first time it was noticed on a relatively open network share, so we just assumed that a user had inadvertantly made the changes. After the second time we set about investigating it, and quickly found the files that the shortcuts were opening along with the "legitimate" target.

 

I think a good starting point is to do a full scan of whatever directory is storing the suspect infected files (not the shorcuts, but the "bonus" files these shortcuts are pointing to). They are usually marked as hidden and system files, so you will need to "show hidden" and "not hide system files" to see them. For us, there were half a dozen suspect files in these directories, all created at the same time. If scans of these folders come up clean (ours initially did), submit samples to your AV provider. For any Sophos users, thats here - http://www.sophos.com/support/samples. For us, this got the files in question classified and within 30 minutes we had IDE updates that could detect and remove it.

 

In addition to updating and scanning both servers and end devices, we started running a handy tool from Sophos called Sophos Source of Infection Tool, which gives names, timestamps and IP addresses of files being writted to specified directories. Running this on network fileshares helped us identify and clear infected hosts.

Edited February 16, 2013 by mistersparky

[bclarke]

We have had this virus. It is spread by memory sticks. First, you need to break the cycle of infection by disabling memory sticks otherwise it just keeps reinfecting every time someone plugs one in. The virus copies two files to the root of a share, if I remember correctly one was an autorun file and other had a random name with exe extension but looked like an msdos logo. You need to delete these from the drives, and depending on how you have set permissions up, it could be everywhere. You may see them pop straight back in there, this is the reinfection and you can look at the file properties to identify who created it and deal with those computers separately. To make your files visible again you need to open a cmd prompt to the folder which is hidden and enter the following command:

 

attrib -h -r -s i:\*.* /s /d

 

This is taken from this website but there is also a tool to help with this mentioned on the site. I didn't use that. You will need to change the drive letter and path of the command. It was a bit of experimenting but I got there in the end.

 

http://techlogon.com/2011/06/07/folders-and-documents-hidden-by-virus/

 

I hope this helps.

 

Ben

[clarky2k3]

Those affected might want to look in the netlogon share as we found that it affected there aswell as one of our other shares!