Security Incidents mailing list archives
Re: Strange Folder
From: "P.P. Lodder" <p.lodder () yifan net>
Date: Sun, 6 Oct 2002 20:17:22 +0200
On Sunday, 6 Oct 2002, discipulus wrote:
The other day I noticed a strange folder had been created on my W2K Pro machine at work.
The folder had been created in C:\Documents and Settings and didn't have an account name but four or five odd looking square block characters instead. When I right click on the folder and choose "properties", it displays the name as "rrrrr".
AFAIK, the only way a new folder would be created in C:\Documents and
Settings\
is for "first time" logins.
I yesterday noted the same when I resetted an user's profile on an NT4 Workstation machine. Today, again. Difference is that here it shows up on the desktop instead of in the profile map (C:\WINNT\Profiles\<user>\Desktop). I logged into the machine as administrator to delete the locally stored profile after doing the same on the server. This was due to incidents with corrupted user profiles, of which i am still researching the cause. Anyone else been seeing this besides us? -- Patrick Lodder p.lodder () yifan net ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- Strange Folder discipulus (Oct 05)
- Re: Strange Folder Nick Jacobsen (Oct 06)
- Message not available
- Re: Strange Folder discipulus (Oct 06)
- Re: Strange Folder Midkaemia (Oct 06)
- Re: Strange Folder discipulus (Oct 07)
- Message not available
- Re: Strange Folder Nick Jacobsen (Oct 06)
- <Possible follow-ups>
- Re: Strange Folder discipulus (Oct 06)
- Re: Strange Folder Neil Dickey (Oct 06)
- Re: Strange Folder discipulus (Oct 06)
- Forensics CD (was: Re: Strange Folder Meritt James (Oct 07)
- Re: Forensics CD (was: Re: Strange Folder Chet Uber (Oct 08)
- Re: Forensics CD (was: Re: Strange Folder Ryan McBride (Oct 08)