"System" and "Hidden" attributes mysteriously appearing on folders

In the last few days we have had a rash of "System" (S) and "Hidden" (H) attributes appearing on data files and folders on a Virtual Server running Server 2003.  I realize anyone who has appropriate Rights can change the attributes to a folder to "Hidden", but the owners of these folders swear they have not done this.  Secondly, it is a lot more complex for someone to assign a "System" attribute to a file or folder; so it is highly unlikely anyone of our Users would even have the knowledge to do this.

Any ideas of what could cause this phenomenon?


Bruce Leypoldt
The Egging Company
Who is Participating?
Brian PringleConnect With a Mentor Systems Analyst II, SCM, ERPCommented:
This is usually caused by a virus or by spyware/adware/malware.  Download either Lavasoft AdAware or Spybot and run it.

Lavasoft AdAware

Spybot Search & Destroy
Bruce_LeypoldtAuthor Commented:
I am running Windows Defender and it didn't pick up anything.  We also have Symantec Anti-Virus Corporate Edition, and it didn't pick up anything either.
We are experiencing the same problem on one server for 2 days now.  Yesterday we did a full scan using McAfee with current dat files.  I also spent several hours on the phone with Microsoft.  We eventually used the DOS attrib command to correct the problem but it is recurring today.  Any other ideas?  I'm getting ready to call Microsoft again right now.
Leave Filemon running on the computers you think are causing this and see what happens.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.