Member Avatar for TheBattman

On the school system where I work, the computer in my room has been backing up the desktop of this computer (Win 98SE) to the main server (Windows/Novell) into a file specifically for Pegasus Email data only.

The tech co-ordinator and I have both been through this machine with a fine toothed comb and cannot figure out why.

The real issue is that this slows down backups of those data folders on the server - plus - WHY is it doing this? This computer is the only one on the entire network doing this - out of a couple hundered machines!

What I did find last week was that my "cookies" folder was also getting backed up - BUT the data in the cookies folder being saved to the server did not match what was on this computer. Instead it contained 567 cookie files with user names of people who have not even been at this school in a couple of years.

What is suspected is that that former student had planted some sort of backdoor/keystroke recorder a few years back and this was what was causing the funny behavior. Unfortunately, the tech co-ordinator does not remember the fix for when this was discovered on other computers a couple of years ago.

What happens is that every time this computer is restarted/shutdown/booted/ogged off and on/etc. it looks for and saves data from this machine. It includes not only a cookies file that does not match the one on this computer, but saves a folder of "Application Data" (with copies of the applications that are represented on the desktop with shortcuts), as well as copies of any folders that may appear on the desktop other than the recycle bin.

I finally just deleted my user from the computer last week. This cured the problem for 1 day, but now it has returned. The only plus is that the cookies folder no longer contains all of those 567 supposed mystery cookie files.

This is driving my tech co-ordinator batty. Anyone have any ideas or suggestions?

I am afraid to try to back everything important up and F-disk this thing - as I don't know what particular file is causing this....

  • 5 Contributors
  • 6 Replies
  • 278 Views
  • 1 Month Discussion Span
  • Latest Post Latest Post by TheBattman

Dani AI

Generated

Summary and focused next steps that build on the suggestions from , and : the behaviour you describe (Desktop + Application Data being copied to a Pegasus file on the server, plus cookie sets that don’t match the local machine) looks like an automated sync/backup process or agent, not just a simple keystroke logger. Do not reformat yet — capture evidence first (disk image and logs) so you can analyse and restore safely.

Local (client) triage — capture the culprit

  • Immediately unplug the network cable and reboot. If the copy activity stops, it’s network‑initiated; if it continues, it’s purely local.
  • Create a uniquely named test file on the Desktop, reconnect the network, then trigger a logoff/login and check whether that file appears on the server (timestamp will help).
  • Run an activity tracer during a login/logoff cycle that watches file and registry activity for the Desktop and Application Data folders (use a file-monitor/registry-monitor and a process viewer to record what process opens or writes those paths). Save the logs and note exact timestamps and process paths.

Server-side checks and where to look

  • Inspect the backup/job logs on the server — they usually record the client hostname/IP and original full path. That will tell you whether the server or a client process initiated the copy.
  • Ask the Novell admin to review login scripts, ZENworks (or similar management agents), and any per‑machine scheduled tasks that might target that workstation specifically. Look for entries that reference “Desktop”, “Application Data”, or “Pegasus”.

Other practical points

  • Search the workstation for installed sync/remote‑control/backup agents (VNC, pcAnywhere, ZENworks agents, custom scripts). Also check for nonstandard services/drivers and recently modified executables.
  • Preserve a full image before removing anything; once you identify the offending executable or script, remove it, reimage the machine from a known good image and restore only verified user data.

This concentrates on “capture first, then remove.” The trace (which process, which account, which machine, and exact timestamps) will give you the definitive lead.

Recommended Answers

All 6 Replies

Member Avatar for TallCool1

On the school system where I work, the computer in my room has been backing up the desktop of this computer (Win 98SE) to the main server (Windows/Novell) into a file specifically for Pegasus Email data only.

Here's a link I found for an online test for this sort of thing: DO YOU HAVE PARASITES?

Member Avatar for TheBattman

No parasites. AdAware and SpyBot both come up clean. Every anti-virus software I can find turns up clean reports.

It has been suggested that this is the result of a keystroke logger + backdoor that was installed by a nefarious student a few years ago.

So far, no luck in finding a solution.

Member Avatar for GrimJack

It would seem to be loading at startup; have you looked at your startup list to see if there is anything suspicious in there? If you have NT or above, you have some system monitoring tools available to see what processes are running. Do you have firewall that monitors what is using the internet connection? ZoneAlarm provides a blinking icon for whatever program is talking . You could use the search feature (WinKey+F) and search for all files created or modifed when you started up your machine.

I hope there is some help hidden in there.

GrimJack

Member Avatar for TheOgre

Is there a remote possibility that it's something on the Novell server, rather than the desktop? Normally, the configuration file for backups is stored on the server, although I've never used Novell so I can't be sure.

Another thought: a keylogger wouldn't determine what gets backed up (it would create log files hourly/daily) but it could be configured to send the logs to a remote location. Try a free firewall and log all the activity for a week or so to see what outbound connections are being opened.

As far as a backdoor, even if there was a port open, there would have to be something on the firewall/router end to route connections from the outside to that IP:port, and I don't think a student would have that access. It's possible it opens a connection to the outside and listens, but again, some simple logging on the firewall should point that out. After that, you should have a good idea which backdoor is in use by using Google to find the port/backdoor match, then find the way to remove it.

Or, reimage the system if an image was created, or wipe the drive and reload the O/S.

The possibilities are numerous...

Member Avatar for Yzk

are there perhaps some files left in C:\windows\temporary internet files\ ?

Member Avatar for TheBattman

are there perhaps some files left in C:\windows\temporary internet files\ ?

Just the expected cookie files and such. I don't see anything suspicious.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.