Question

Locked

Need feedback on issue with file sizes being changed to 0 recently

By laurietaylor ·
Working on a MS 2003 server. Multiple files in a subdirectory all with same create/modify dates of May 2011. Suddenly, I noticed SOME of the files in this subdirectory have 0 bytes sizes and the date and times are all for the same date, July 27, 2011. This issue doesnot seem to be affiliated with specific file types as I did a scan across the server and saw this occur even with PKZIP files. The scan also showed me other files within other subdirectories with different dates. This issue seems to have started around the middle of July 2011.

Trying to research some probable causes: (a) files in my folder were not "dragged and dropped" from one location to another either (b) network admin assured me only thing that has changed (other than service pack updates) was a new backup software was implemented in July. It does do file size checking however my files that changed to 0 were last changed in May 2011. I've never heard of a backup software that could do that.

I also read somewhere that in 2008, there was a trojan horse Serauth1.dll that would cause this type of situation. I've got the admin double checking the anti-virus software to make sure this is included in the list of virus/trojans/malware to check for.

Any other ideas are greatly appreciated. Appears that every day some addtl files are being changed.
Any other ideas

This conversation is currently closed to new comments.

3 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Answers

Collapse -

Sounds like a virus

Definately sounds like a virus hosing things up. There are several out there that will do similar things. You need to identify the last good backup and protect that from being overwritten so when you get the server cleaned you have at least something to restore. Sounds like you're losing more data every day so you don't loose more data.

Collapse -

Reponse To Answer

by laurietaylor In reply to Sounds like a virus

Agreed. The last back is secured and we did do a virus scan and nothing showed up. That's why I have asked to make sure that trojan horse is in the "known" virus's/malware that is being checked for. Thanks for your quick response. Definitely appreciated.

Collapse -

If all of the files are 0 and have the same Time Stamp

by OH Smeg In reply to Need feedback on issue wi ...

I would look at an error with the Backup Software where it's been set to save to the Source Destination and not saving the contents of the files but just the File Names.

I've seen that in the past where a mistake been made with newly installed software or even during the actual install.

I would first rule out Infections with a Live Rescue Disc like F Secure but here I'm supposing that this is in use so you'll have to take it Off Line after Hours if possible to scan or demote it if it needs to be running 100% of the time to check it.

But depending on the Backup Software it could be something as simple as a Screw Up during it's install.

Col

Back to Networks Forum
3 total posts (Page 1 of 1)  

Related Discussions

Related Forums