wierd things happening to teachers user areas

[sted]

their desktop /user areas seem to be full of shorcuts that look likle their documents rather than the docs themselves the shortcut looks something like

 

C:\Windows\system32\cmd.exe /C start cmd.exe /C if exist "..\Documents\My Music\iTunes\iTunes Media\Music\uVXUA.pYXN" start "" "..\Documents\My Music\iTunes\iTunes Media\Music\uVXUA.pYXN" && start "" "What can I see la.docx" the old files are all there but hidden

 

any ideas

 

it also seems to of done something slightly odd to server i have permissions to users$ but on the server (and only the server) i cant get into the folder (its like uac is turned on but its not)

Edited December 5, 2012 by sted

[Geoff]

Virus on the end users machine.

[sted]

Virus on the end users machine.

 

sophos says no (not that i trust sophos but its what ive got)

[Geoff]

I'd run something else as well across it. Spybot or Malwarebytes are pretty good. Also upload that 'uVXUA.pYXN' file to VirusTotal and see what it comes back with.

[sted]

I'd run something else as well across it. Spybot or Malwarebytes are pretty good. Also upload that 'uVXUA.pYXN' file to VirusTotal and see what it comes back with.

 

the file dosent exist as far as i can see

 

sophos did find cxmal/badlink-a on the server as im running a full scan now

[Geoff]

It might be that sophos cleaned it up then but didn't repair the shortcuts?

[sted]

It might be that sophos cleaned it up then but didn't repair the shortcuts?

 

not according to the log its found squat the server found it when i vulk shifted every .lnk file to a temp folder for later perusal

[sted]

looking further back in the multitude of logs it has found a few issues ffs id love to get hold of the @}{*'s who write viruses

[Geoff]

Are you sure about that? The Russian maffia aren't very nice people.

[sted]

Are you sure about that? The Russian maffia aren't very nice people.

 

tbh i reckon as many are written by av firms as not keeps them in proffit