File Name Renaming

Dan
Dan used Ask the Experts™
on
Is this an indication that I have a virus or something?  Has my server been hacked, I'm running windows server 2012 R2.

file name renaming
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Distinguished Expert 2018
Commented:
It's simply a backwards compatibility warning. Because "program files" is a default folder on windows, some older programs that still use DOS style 8.3 names can cough up furballs if another folder exists that is just called "program"  ...it is better to use something more unique. Even adding a "1" does that.
DanNetwork Engineer

Author

Commented:
but I never tried to create a folder called Program, it just comes up by itself.
Top Expert 2016

Commented:
somewhere, somehow, malware, installed program, task schedule the probable cause is missing quotation marks around c:\program files\blah which then creates the folder c:\program and then errors out.
OWASP: Forgery and Phishing

Learn the techniques to avoid forgery and phishing attacks and the types of attacks an application or network may face.

Top Expert 2013
Commented:
check with Explorer if such a folder exists
it can be caused by other software - or malware; if so run http://www.malwarebytes.org/mbam.php
DanNetwork Engineer

Author

Commented:
the same message appeared now on a 2nd server, this is strange. I'll run for malware, but I doubt it's that.
NVITEnd-user support

Commented:
Per your original image, does this happen at startup, e.g. after you logon?
DanNetwork Engineer

Author

Commented:
When I log into the server.
NVITEnd-user support

Commented:
Check for suspects. your Startup folder, and Task Scheduler, and registry keys:

C:\Users\username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
DanNetwork Engineer

Author

Commented:
C:\Users\username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
(Nothing here, empty)  But it could be in other profiles, as there's a lot of other account profiles on this server

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
(Nothing here, empty)  But it could be in other profiles, as there's a lot of other account profiles on this server

 I've attached what's in msconfig.
startup
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
(The only thing here is my symantec backup exec exe file)

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
(nothing here)

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
(everything.exe is here, which is I know what it is, but then I don't know what this is,
it's MtxHotPlugService.exe v)  It's in the system32 directory, so I'm assuming it's part of the OS.

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
(Nothing here)

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
(That folder does not exist)

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
(That folder does not exist)
NVITEnd-user support
Commented:
> everything.exe is here, which is I know what it is, but then I don't know what this is,
??

If possible, note down then temporarily disable those msconfig items. Then logoff and logon to see the effect.
DanNetwork Engineer

Author

Commented:
Its my sql server so I can't restart it during production hours.
Top Expert 2013

Commented:
did you check -as i asked - if the program folder exists??
Top Expert 2016
Commented:
Sysinternals Autoruns will check all locations
DanNetwork Engineer

Author

Commented:
Thanks guys, I should have remembered about autoruns, I used to use it frequently.

I found that my AV program, Webroot was trying to create a folder called program in the rot of C.

I escalated the issue with webroot.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial