Security Incidents mailing list archives

Re: Strange Folder


From: "P.P. Lodder" <p.lodder () yifan net>
Date: Sun, 6 Oct 2002 20:17:22 +0200

On Sunday, 6 Oct 2002, discipulus wrote:

The other day I noticed a strange folder had been created
on my W2K Pro machine at work.

The folder had been created in C:\Documents and Settings and
didn't have an account name but four or five odd looking square
block characters instead.  When I right click on the folder and
choose "properties", it displays the name as "rrrrr".

AFAIK, the only way a new folder would be created in C:\Documents and
Settings\
is for "first time" logins.

I yesterday noted the same when I resetted an user's profile on an NT4
Workstation machine. Today, again. Difference is that here it shows up on
the desktop instead of in the profile map
(C:\WINNT\Profiles\<user>\Desktop). I logged into the machine as
administrator to delete the locally stored profile after doing the same on
the server. This was due to incidents with corrupted user profiles, of which
i am still researching the cause.

Anyone else been seeing this besides us?

--
Patrick Lodder
p.lodder () yifan net


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com


Current thread: