0 Replies Latest reply on Feb 26, 2010 2:34 PM by slangendorf

    Strange UNC Directory sorting by name length (tree shaped)

      Has anyone seen a directory listing that is sorted by the length of the file\folder names, starting shortest at the top and longest at the bottom?

       

      This only happens when listing the files on a remote system and appears to be a characteristic of an infection that does something to the SMB network stack. I installed Artemis on a machine with this behavior and after finishing an full scan (Heuristics=Low) the directory then looked normal but I couldn't find any new quarantined files or any detections in the log files, unless I missed a log file ;-)

       

      So, dir \\servername\sharename looks like this.

       

      06/13/2007  03:34 AM    <DIR>          Dell

      08/14/2006  02:58 PM    <DIR>          I386

      08/08/2007  03:14 AM           338,271 s4l0

      02/24/2010  11:00 AM    <DIR>          TEMP

      08/14/2006  01:39 PM    <DIR>          wmpub

      08/08/2007  03:14 AM                18 s4l0.1

      05/15/2009  07:00 AM    <DIR>          Drivers

      10/08/2009  06:19 AM    <DIR>          xxxools

      10/05/2009  05:19 AM    <DIR>          scripts

      02/24/2010  11:28 AM    <DIR>          Windows

      05/02/2007  04:33 AM    <DIR>          printmig

      07/04/2008  12:35 AM             2,739 HPDIU.log

      04/15/2009  03:29 AM               947 HPSIU.log

      08/14/2006  01:39 PM                 0 config.sys

      09/30/2008  01:33 AM    <DIR>          Geoscience

      02/23/2010  01:15 PM    <DIR>          Mcafeelogs

      02/17/2007  05:31 PM            94,720 msizap.exe

      02/22/2010  09:02 PM    <DIR>          quarantine

      10/27/2009  02:01 PM           764,727 VSECFG.CAB

      05/07/2007  09:21 AM                80 CApatch.LOG

      04/02/2008  10:02 AM    <DIR>          spoolerlogs

      08/14/2006  01:39 PM                 0 autoexec.bat

      02/24/2010  02:48 AM    <DIR>          Program Files

      05/15/2009  09:01 AM               127 xxxxxxxFile.log

      06/26/2008  03:44 AM            11,863 xxxxxInstall.log

      08/04/2008  03:00 AM    <DIR>          xxxxxxxxxxxPCL6-32

      08/14/2006  01:45 PM             2,016 startup_debug.log

      06/12/2008  03:24 AM    <DIR>          BrightStor SRM Data

      06/02/2009  06:50 AM    <DIR>          xxxxxxxxxxxxx Printer

      02/23/2010  04:33 PM    <DIR>          Documents and Settings

                    12 File(s)      1,215,508 bytes

                    18 Dir(s)  133,292,883,456 bytes free