I found out that this folder was created when I installed Service Pack 1. I deleted it and saw it again after installing IE 5.5 Thanks to Ken Morris for suggestions. On Fri, 21 Sep 2001, Birl wrote: sab> Running Windows 2000 Advanced Server (no Service Packs) as a stand-alone. sab> Not running Active Directory. This is an IIS server with most of the sab> needed IIS patches installed (has already thwarted CodeRed and SADMIND). sab> sab> I found a mysterious folder under C:\Documents and Settings\ sab> called <computername>$ sab> sab> ie: BlackBox-01$ since the name of the computer is BlackBox-01. sab> (C:\Documents and Settings\BlackBox-01$) sab> sab> I have another computer, NetBIOS name is BIRL. It has a folder called sab> C:\Documents and Settings\BIRL$ sab> sab> I know that the folder names under "Documents and Settings" are named sab> after the users who log into this server, but: sab> sab> 1) There's only 4 user accounts Administrator, Guest (disabled) sab> IUSR_BLACKBOX-01 and IWAM_BLACKBOX-01 sab> 2) This server is in a restricted area. sab> sab> sab> What catches my attention: sab> sab> 1) Not all of the servers that are running Win2000 A.S. have this folder. sab> 2) The folder contains following tree structure sab> sab> BlackBox-01$\ (This name depends on the computer name) sab> Application Data\ sab> Microsoft\ sab> Internet Explorer\ sab> System Certificates\ sab> My\ sab> Certificates\ sab> CRLs\ sab> CTLs\ sab> Local Settings\ (hidden) sab> Application Data\ (hidden) sab> History\ (hidden) sab> Temp\ sab> Temporary Internet Files\ (hidden) sab> NTUser.dat (hidden file) (in use) sab> NTUser.dat.log (hidden file) sab> NTUser.ini (hidden file) sab> sab> sab> The only places where I found NTUser.dat* (on other systems) was: sab> C:\Documents and Settings\Administrator\ sab> C:\Documents and Settings\Default User\ sab> C:\WinNT\Repair\ sab> sab> It's creation date is 08/22/2001. It's modified date is the same. sab> sab> To be safe, I removed the server from the network and restored a Norton sab> GHOST image from 08/21/2001. It did NOT have this folder. sab> sab> So within a 24-hour period, this folder was created. sab> sab> Does anyone know how this folder may have been created? sab> Im currently looking at any programs or updates I may have installed. sab> sab> Before restoring the GHOST image, this server was on the network, I sab> tighten down the services and TCP/UDP ports. So I am at a loss as to how sab> this folder may have been created. sab> sab> There are no additional users and/or groups created. And I am the only sab> person with the Administrator password. The computer remains off of the sab> network since I restored the GHOST image. sab> sab> sab> sab> Thanks again. sab> sab> Scott Birl [EMAIL PROTECTED] sab> UNIX Consultant/Systems Administrator Computer Services Temple University sab> 1805 North Broad Street Philadelphia Pennsylvania 19122 United States sab> ====*====*====*====*====*====*====*====+====*====*====*====*====*====*====*====*
