Strange folders being created with 'chmod 740' in filename

My colleague has a Mac Mini Intel 1.6Ghz with 1Gb RAM. He has recently discovered that the top level of his hard drive has had 48 folders created, each with the phrase "chmod 740" at the end of the filename. The names all follow the same style: it starts with the name of a file (for example, "cover"), then it follows it with "; chmod 740".
Within each folder it then reconstructs the file structure of the path to the original file.
There doesn't seem to be any consistency behind any of these files; it seems that all sorts of files are created, from Quark XPress documents, PDFs, postscript files, text files; and not all the files in the folders have been duplicated - only a random selection.
Does anyone have any ideas what's causing this problem?
All help gratefully received.

This is strange. chmod 740 is a unix command to change file ownership of a file/folder to make the owner of it be able to read/write to it and make it executable, and the group read only.
I don't know if this is some kind of attack or if it is just some application gone crazy, or if the owner of the computer has been doing some batch file renaming and changing of permissions.
Move those files to a folder and Run Repair Permissions using Disk Utility.
See if any file permissions repaired by Disk Utility correspond to any of those odd folders. If they do, then their file permissions were changed which would lead to the question what changed them and why.
Afterwards you could delete them.
Message was edited by: roam

Similar Messages

  • Lightroom 4.3 Duplicate folders being created on import

    Hi, is anyone else gaving issues with duplicate folders being created with Lightroom 4.3 on import?
    When I import photos, they go to a folder with a name "XXX" for example.
    The folder is in a hierarchy of "2013, March, XXX".
    Lightroom creates a folder  here and above 2013! It is making a mess of my library.
    Also, when I import using Photo Mechanic (great software that just works!) and then do a "synchronize folder" in Lightroom, only 1 photo is transferred.
    Is there a fix for these bugs?

    It looks to me as though you've fallen victim to the "capitalisation" issue....in your Folders Panel your year folders names have the word "LIBRARY" in capitals, yet in the screenshot of the import dialog you are importing to "LR_Library_2013". I guess at some point you changed the capitalisation, and although the OS doesn't distinguish between the two formats, Lightroom unfortunately does.....so although all the images/sub-folders are within the one actual year folder, Lightroom sees them as two different parent folders.
    So which one is the correct format as shown in Win Explorer? I'm guessing the lower-case version? If so, the quickest way to fix this is as follows:
    1. Backup your catalog.
    2. Create a root level folder on the C drive, call it whatever you want, say "Capitals Fix".
    3. Right-click on the "LR_LIBRARY_2013" year folder in the Lightroom Folders Panel and select "Update Folder Location". In the file browser that then opens, browse to and select the "Capitals Fix" folder on the C drive.
    4. Don't be alarmed as the 2013 folder will disappear from the Folders Panel, "Capitals Fix" will appear but all the sub-folders that were listed under 2013 will now have "?" marks.
    5. Now right-click on "Capitals Fix" in the Folders Panel, and again choose "Update Folder Location". This time browse to and select the correct "LR_Library_2013" folder on the A drive. You may get a "Merge" dialog box, select "Merge" and everything should resolve itself.
    6. Repeat if needed for the 2011 and 2012 year folders, though as you're likely not importing into there any longer you may not encounter the problem.

  • Accounts being created with administrative group rights

    Hello,
    The server is a Windows 2003 R2 Enterprise fully patched used for Shared Hosting purposes.  It runs Hsphere control panel.  I am trying to identify how the following hack is happening. 
    1) There are users being created with Administrative group rights.   Below is the EventViewer log for the user creation:
    User Account Created:
         New Account Name:    username
         New Domain:    PCNAME
         New Account ID:    PCNAME\username
         Caller User Name:    PCNAME$
         Caller Domain:    DOMAINNAME
         Caller Logon ID:    (0x0,0x3E7)
         Privileges        -
     Attributes:
         Sam Account Name:    username
         Display Name:    <value not set>
         User Principal Name:    -
         Home Directory:    <value not set>
         Home Drive:    <value not set>
         Script Path:    <value not set>
         Profile Path:    <value not set>
         User Workstations:    <value not set>
         Password Last Set:    <never>
         Account Expires:    <never>
         Primary Group ID:    513
         AllowedToDelegateTo:    -
         Old UAC Value:    0x2DAB2B0
         New UAC Value:    0x2DAB2B0
         User Account Control:    -
         User Parameters:    <value not set>
         Sid History:    -
         Logon Hours:    <value changed, but not displayed>
    There exists entries as well where the primary group ID is changed to the Administrative group, but I am omitting such.
    2) I tried to identify what Caller Logon ID:    (0x0,0x3E7) means.  I found out from here:
     http://blog.joeware.net/2013/01/14/2667/ that I can use LogonSessions.exe to identify it.
    Output from LogonSessions.exe is pasted below (snippet):
    [0] Logon session 00000000:000003e7:
        User name:    DOMAINNAME\PCNAME$
        Auth package: NTLM
        Logon type:   (none)
        Session:      0
        Sid:          S-1-5-18
        Logon time:   9/11/2014 12:41:53 PM
        Logon server:
        DNS Domain:   
        UPN:          
            4: System
          316: smss.exe
          364: csrss.exe
          392: winlogon.exe
          440: services.exe
          452: lsass.exe
          628: svchost.exe
          756: LMAgent.exe
          840: svchost.exe
         1000: spoolsv.exe
         1252: avagent.exe
         1268: camWMIAgent.exe
         1324: cissesrv.exe
         1380: cpqrcmc.exe
         1404: vcagent.exe
         1440: svchost.exe
         1480: HsQuotas.exe
         1740: inetinfo.exe
         1780: EmailAgent.exe
         1856: snmp.exe
         1884: sysdown.exe
         1920: smhstart.exe
         2192: svchost.exe
         2388: cmd.exe
         2396: hpsmhd.exe
         2444: cqmgserv.exe
         2464: cqmgstor.exe
         2484: HSphere.exe
         2596: wmiprvse.exe
         2676: cmd.exe
         2684: rotatelogs.exe
         2692: cmd.exe
         2700: rotatelogs.exe
         2732: searchindexer.exe
         2812: hpsmhd.exe
         2824: cqmghost.exe
         2852: svchost.exe
         3044: cmd.exe
         3052: rotatelogs.exe
         3080: cmd.exe
         3088: rotatelogs.exe
         5452: svchost.exe
         5596: GravitixService.exe
         7392: csrss.exe
         7232: winlogon.exe
         6888: csrss.exe
         9832: winlogon.exe
        10388: wawrapper.exe
        10352: cpqnimgt.exe
         9496: msiexec.exe
         6068: w3wp.exe
         4748: webalizer.exe
    3) I also learned from http://support.microsoft.com/kb/243330/en-us that   Sid:          S-1-5-18 means:
    SID: S-1-5-18
    Name: Local System
    Description: A service account that is used by the operating system
    That is all great info, but I am not sure I can put together what I have learned to attempt and get closer towards identifying how in the world users are being created and then being assigned administrative group rights.
    I am a Linux person mostly, but I am comfortable following a properly explained thread regarding windows 2003 R2 Enterprise issues.
    The server is fully patched and it is running Lumension security product.  What's more, Norman Malware tracker, tdskiller.exe (Kaspersky) and McAfee rootkitremover.exe have been run without any apparent Malware/Virus infection
    Hope someone with advanced admin skills can advise.
    Thank you

    Hi,
    You mentioned that, “I am trying to identify how the following hack is happening”, would you please tell us that why did you think the event represent a hacking behavior?
    In a Shared Server Hosting environment, the underlying hosting control panel tool (Hsphere in this case) should be creating only virtual FTP users with a specific group.  So no users with Administrative group should be ever created.  If this happens,
    it constitutes a breach of server security=positive hacking attempt.
    >how in the world users are being created and then being assigned administrative group rights.
    In addition, would you please be more specific about this question? Did you find the event message on a domain joined machine?
    I want to be able to understand in full how/what process is allowing users to be created with Admin rights.  In other words, I want to know what IP was used to issue the command, if ASP.net was used (abused in this case), or anything else related to
    it so that we can patch this particular hole.
    Best Regards,
    Amy

  • How do I locate the folders I created with my downloaded music?

    How do I locate the folders I created with my downloaded music?
    Thanks for any information,
    Dawn

    I have no problem pulling up a complete list of downloaded music.  My problem exists with past downloads I put into a "Folder" then copied that folder to a CD.  A bit frustrating.
    Thanks for your input,
    Dawn

  • Identical folders being created when I sync a folder

    This is strange error so bear with me as i try to explain it. This started when I upgraded to OS X 10.10 on my iMac 2013 with lightroom 5.6
    All my pictures are stored on an external thunderbolt drive, a "Lacie" thats the drive name label thus in lightroom this is the Name as it appears in my folder Pane.
    I use a third party app to import to copy my images from my camera to the computer. i then use lightroom to simply Sync a folder to import them into lightroom. i've been doing it like this for years, never had an issue.
    Until today. note: I reverted to a previous backup catalog but same problem.
    When I sync it will create an identical "Lacie" folder and sync files to this new location.
    the expected result is if I sync a folder named '2014' that it simply sync files to this location instead it creates a new "Lacie" and puts the images there.
    When I go to my original LAcie, it says they are 0 files int but when i show in finder all images are there??
    why does lightroom create a new location? why is it identical name? and how do I remove it? i see no way to remove them.
    I'm willing to start over again I guess but I'm unable to remove the older "lace" location hence in my Folders pane i have multiple "lace' and i see no way to remove them.
    and if i start over again this might happen again so i'd like to know how to prevent this?
    The external drive has not been removed, its always powered and connected.
    i am unable to sync folders to my original 'lace' folder. when i sync on my original folder its detecting everything like it was never synced. if i say ok to this it puts it all into the new 'lace' folder, when clearly it should be syncing to the original 'lace' folder location.
    any ideas whats going on here?

    If you are using iPhoto or Aperture for Mac OS X, your photos automatically sort on your device in the same order in which they are sorted in iPhoto or Aperture. Changes made to the sorting of your pictures in your iPhoto or Aperture albums and events are reflected on the device after syncing.
    If you are not using iPhoto or Aperture on Mac OS X, and if your device is using the latest software, it sorts photos in ascending order by the Date Modified when viewing all your photos together in the Photo Library (or Photos tab for iPad). When viewing a photo album, the photos are sorted alphanumerically by the photo file names.
    iOS 4 and I believe the same for iOS 5 sorts photos by the Date Taken tag of the photos. Specifically, your device uses the pictures' EXIF tags to determine the Date Taken information. Your device will look for the following EXIF tags within your pictures:
    Capture Date
    Date Time Digitized
    Date Time Original
    Last Modified
    To change the sort order, you must change the Date Taken of photos on your computer. Third-party photo-management software may be able to do this. Refer to the documentation of your photo-management software for more information. In some cases, photos may not have a date in any of the above four EXIF tags, or photos may not support EXIF data (such as JPEG 2000, TIFF, PNG or GIF files). In this case, your device sorts these photos by the date the files themselves were created (as listed in the Date Created field in OS X Finder or Windows Explorer).

  • Auto Save folder not being created with new project

    Just recently I've noticed that when I start a new project there is no auto save folder being created.  I have all preferences the same (auto save every 10 min with a max of 50 and save next to project files).  I have no idea why this started or what I can do to fix it. 

    So it seems to be working now.  I went back through other projects that have been open for some time and the most recent auto save file I could find for any of them was from Oct. 8th.  So auto save hasn't been working at all.  What I did was go into preferences and change the interval a little and the frequency from where I had had it since intial set up.  That seemed to have told it to turn it back on for some reason.  It's really weird.  I guess I'll just keep an eye on it, but people may want to check there folders just in case the same issue is happening.  I didn't realize it until today and it's been happening for a couple of weeks apparently. 

  • XMP files not being created with DNGs...

    I'm used to using Bridge with ACR to process Nikon NEFs. But a recent camera update has me experimenting with converting the D3's NEFs to DNG files and editing them with CS2 and Bridge 1.04 which works better on my system. I've also experimented with CS3 and Bridge 2.1.1.9 with the same DNG files.
    In both cases XMP files are not being created when working with DNG files. I have enabled "Save image settings in : Sidecar ".xmp" files" turned ON. But they do not seem to be generated and I assume the ACR adjustments are being embedded in the DNG file. Meanwhile doing edits on NEF files continues to create .xmp files as expected.
    I find .xmp files to be very useful and I'm wondering why they're missing with DNG files? Are they hiding somewhere other than in the same folder that the images reside in?
    Thanks.
    Russell

    > The information contained in the XMP file is stored in the DNG file so there is no need for a separate file.
    Aww, yuck!! That's a real drag...
    When editing lots of files (yesterday's shoot produced 8GB) I back everything up to off-line storage and then, after doing all my edits and crops in ACR, I only have to copy over the small XMP files which takes no time at all.
    So if I re-edit the DNG with ACR I have to re-copy ALL the files again to the off-line storage.
    I used to sometimes even save 2 versions of the xmp files when I needed 2 different crops of the same images, such as doing a wide screen 'cinema' crop for a corporate client's Intranet presentation of their event, as well as more standard crops to be used for their newsletters.
    Guess I won't be using DNG any more..
    Thanks for the help Kees :-)
    Russell

  • Duplicate folders being created within folders

    I am noticing that since we started using Contribute on our
    website that duplicate folders are being created within the folder.
    For example - I have a folder called Ministries. Inside Ministries
    are three subfolders - Peru, Brazil & Mexico. I'll go in to
    upload a page to the Mexico subfolder and find that the entire
    Ministries folder has been duplicated inside the Ministries folder.
    So instead of looking like this:
    Ministries -
    Peru
    Brazil
    Mexico
    It looks like this:
    Ministries -
    Peru
    Brazil
    Mexico
    Ministries
    Peru
    Brazil
    Mexico
    Has anyone else encountered this? I haven't been able to find
    any coding issues that would account for this. I admit that I
    probably just don't know enough to know where to look.
    Any assistance would be greatly appreciated.

    Hi,
    I am unable to reproduce this issue when using Contribute.
    Could you please check if that system is infected by any
    virus?
    Please look the following site:
    http://www.imserba.com/forum/archive/index.php/t-71175.html
    Thanks,
    Radhika

  • Folders being created inside movies ?

    Forders keep being created inside movies. The label is (A Document Being Created By Stomputil).  The title is the same each time except that a number is added to the end and increments up.
    I Have not seen this before Yosomite. 
    IS this a cause for concern and what's this all about ? I have searched and found enough reference to Stomputil to think its not malware, but no reference to my case.

    Tom Wolsky wrote:
    ... How'd you get Music & Sounds up into the toolbar?
    cmd-'n drag allows you to place any files/folders into the commands-bar.
    cmd-'n drag allows to drag any unwanted content out of the command-bar ...

  • TLB STO's created in ECC via cif are being created with Intercompany Markup

    STO's created using TLB in APO when cif'd over to ECC6 get created with an Intercompany Markup.  When created manually in ECC6 using ME21N the markup is not part of the pricing and is correct.  Has anyone had this same situation?

    Abhishek,
    ECC Route is is part of ECC Transportation and Delivery scheduling,
    ( http://help.sap.com/erp2005_ehp_02/helpdata/EN/dd/5607e7545a11d1a7020000e829fd11/frameset.htm )
    and is not directly linked to SCM means of transport in standard SCM.  The analogue to Route in SCM is found in shipment scheduling in SCM.  If you wish to link route to alternative Means of Transport, you will need to use an enhancement.
    If you elect to use the more standard 'shipment scheduling' functionality to schedule your STOs instead of an enhancement, you do not need to implement the entire TLB or TPVS, you can pretty much implement just the shipment scheduling functionality.
    http://help.sap.com/saphelp_scm700_ehp02/helpdata/EN/05/f8923945b12c4de10000000a114084/frameset.htm
    Best Regards,
    DB49

  • Duplicate text files being created with ~ appended

    Whenever I edit a text file with TextEditor and save it, a duplicate file is created with a ~ appended to the end of the name.
    Example:
    After editing and saving my_file.txt my_file~.txt is also created.
    The result is I get two files with exactly the same contents.
    my_file.txt
    my_file~.txt
    I would really like to stop it from doing this. It clutters up everything. It has done this since I first installed the OS. My file system format is Mac OS Extended (Journaled). Any suggestions?

    I looked through the preferences for TextEditor. I had "Delete the automatic backup file unchecked". I think checking this option will fix the problem.

  • Sales Order Outbound IDOC - Restricting Items being created with a Segment

    Hi,
    I have a requirement to restrict segments being created for Items (Child) in Sales Order Outbound IDOC based on conditions in the Items (Parent & Child). Can you please suggest me a suitable solution?
    Basic Type: ORDERS05, Message Type: ORDRSP. What is the IDOC Function Module to be used to create Outbound IDOC for Sales Order?
    Appreciate Your Help.
    Thanks,
    Kannan
    Edited by: Kannan SA on Jan 3, 2008 3:03 PM

    Hi,
    if the segments are mandatory then you can't trigger the idoc without those segments.
    Otherwise, you can read the segment and clear all the data in it, the segment will not be attached to the outbound idoc.
    Where to do it? Search the CALL CUSTOMER-FUNCTION '002' for the outbound idoc for example IDOC_OUTPUT_INVOICE for Invocing.
    Regards,
    Baburaj

  • CcmEval Scheduled task not being created with "Access Denied" error 0x80070005 only on XP machines

    Before coming on here I checked out http://social.technet.microsoft.com/Forums/en-US/ddbfe6c3-ee54-4b2a-a3a7-a6515d974f76/client-check-failed-on-xpserver-2003-systems-onlyccmeval-is-not-being-scheduled?forum=configmanagerdeployment (GPO
    to allow scheduled tasks by users) and another thread about a hotfix that seems to be pre-XP SP3 and pre-CM 2012 R2.
    That said, I'm having an issue many seem to have, but I can't find the answer. From what I understand SCCM uses the user context to create the CcmEval task, but in XP users cannot set a task to run as any other user (ie SYSTEM in this instance) so what is
    the workaround? I can't just give users Administrator permissions to install the client.
    The exact log entries are:
    <![LOG[Client evaluation task doesn't exist.]LOG]!><time="19:05:43.548+360" date="12-14-2013" component="CcmEvalTask" context="" type="2" thread="4356" file="ccmevalcheck.cpp:705">
    <![LOG[Client evaluation task is not found or is disabled or is not compliant, perform remediation]LOG]!><time="19:05:43.548+360" date="12-14-2013" component="CcmEvalTask" context="" type="2"
    thread="4356" file="ccmevalcheck.cpp:341">
    <![LOG[Attempting to recreate client evaluation task.]LOG]!><time="19:05:43.548+360" date="12-14-2013" component="CcmEvalTask" context="" type="1" thread="4356" file="ccmevalcheck.cpp:833">
    <![LOG[Task scheduler 2.0 is not supported, peform task registration with 1.0 API.]LOG]!><time="19:05:43.548+360" date="12-14-2013" component="CcmEvalTask" context="" type="1" thread="4356"
    file="ccmevaltask.cpp:345">
    <![LOG[Failed to delete task Configuration Manager Health Evaluation (0x80070002).]LOG]!><time="19:05:43.548+360" date="12-14-2013" component="CcmEvalTask" context="" type="2" thread="4356"
    file="ccmevaltask.cpp:379">
    <![LOG[Failed to create task item (0x80070005).]LOG]!><time="19:05:43.548+360" date="12-14-2013" component="CcmEvalTask" context="" type="3" thread="4356" file="ccmevaltask.cpp:387">
    <![LOG[Failed to create client evaluation task.]LOG]!><time="19:05:43.548+360" date="12-14-2013" component="CcmEvalTask" context="" type="2" thread="4356" file="ccmevalcheck.cpp:850">
    The bolded section is what's telling me it's Access Denied, and manual creation of any program task set to run as SYSTEM tells me the same- users cannot do this; only admins can.
    What can I do?

    So after sifting through some RSOP results and GPO objects I found a policy that wasn't necessarily prohibiting creation of them. (Not where you think it would be - under
    Administrative Templates > Windows Components > Task Scheduler > "Prohibit New Task Creation" -
    this was set to allow them) but this one I found was a File Permissions policy that set SYSTEM permissions to READ and EXECUTE.
    I've changed this to FULL CONTROL for SYSTEM. I'm unable to get on the machines to examine everything closely, but from what I can see at least one of them has remediated themselves and now has a successful client check in the console. Hopefully the rest
    of them will come around as GP updates itself and the client does an evaluation to remediate the Scheduled Task.
    Hopefully this helps someone in the future as well.

  • Mystery Folders Being Created by Numbers (and Pages) on Server

    Gentleones,
    I'm running a Mac OS X Server 10.6.8 installation with multiple 10.9.1 clients. All clients are using iWork v. Latest and were all updated from 10.x and iWork '09. to get here.
    When opening and then saving a Numbers (or Pages) document on the server, a folder with the same name as the original appears on the server. The contents look suspiciously like a bundle or package with the guts of the document in the folder.
    The original document also gets modified when the document is saved.
    Deleting the folder does not seem to affect the original document in any way.
    It does this with alarming consistency.
    Today, it exhibited a new behavior: a second document appeared with the same name. Though I wasn't able to see it on the server, several of the clients showed this second copy of the document. Others did not.
    I have repaired permissions on the server and have ensured that all of the files and folders have "Read & Write" permissions for the root share point for "This folder, child folders, child files, all descendants". That I can tell, it's not a permission problem as each user can delete the mystery folder when it appears.
    However, that said, I do have multiple users logging into the server using one username across several clients. That shouldn't cause a problem.
    Users do not access the files in question at the same time.
    Any ideas?
    Thanks,
    Bill

    Same problem here. Im running an OS X Mav Server 3.0.2 with shared folders over AFP. But for me it is not consistent at all. Sometimes it creates a "mystery folder" and sometimes not. It only happening with the iWork apps tho.
    The other problem you were mentioning with duplicate folders in the client finder, but in server terminal (ssh) theres only 1 file, happened to me, but only 1 time.
    I always thought it was related to autosave feature of iWork/os x, or file versions. I have turned of autosave on clients and server but problem still persist.
    Could it be related to versions? I dont know for sure how to disable versions in the iWork apps, but it shouldnt be neccecary FFS.

  • Locally cached copy of roaming profiles are being created with username.domainname.00x suffix

    First off let me give some background as to where we've come from and how we got to where we are today.  In my organazation we initially setup a Win 2k3 domain with roaming profiles.  The roaming profiles worked without a problem for about 6 years.  We migrated to a Windows 2k8 domain (non-2008 native mode) about two years ago.  Profiles have been working fine.  We recently did a rollout of 80% of our client machines with newly leased machines.  Once we did this, the profile issues have been...interesting to say the least.  I've been seeing a couple machines having issues loading their profiles correctly.  The users will complain of not being able to use MS Outlook, or they don't have their proper desktop icons on their desktop.  These erros can present themselves when the user changes their domain acct. password (per our security policey) or it may happen just out of the blue.  The user may be working perfectly fine on Monday, and then log off and on Tuesday when they login to their computer, the user will have these problems.  When this is reported to me, I login the computer that is having the issue and I look at the C:\Documents and Settings folder and I'll see sometimes multiple bogus profiles.  The profiles have a naming convention of %username%.%domainname%.00X .  The .00X will increment up 1 with each bogus profile.  Each of these bogus profiles will have only the local settings folder in them.  In order to fix this problem, we typically delete all the local profiles and let the computer pull the server copy back down.  Can someone please shed some light on this for me.  Thanks. 

    I have the exact same issue. All my machines are SP3 as well. I have tried UPHClean and it makes no difference. It's completely random when the username.domain.000 accounts start appearing and accounts become corrupt causing the same issue with outlook or a different set of desktop icons. After almost 3 months of having to reset user profiles (we have 1700 AD accounts and 3 IT guys), here's what I've found to this point.
    WINLOGON.EXE is the culprit. UPHClean doesn't appear to work well with SP3 or this particular version of WINLOGON. WINLOGON.EXE is locking (handle) the profile directory itself.
    7F8: File  (RW-)   C:\Documents and Settings\(User Directory)
    You cannot even run a batch script or something to "restart" winlogon to unlock the folder because it's a system process. When the user logs back in, the pc sees there is already a user profile folder there so it creates a new one with the domain name, rinse and repeat and you get:
    Username
    Username.Domain
    Username.Domain.000
    Username.Domain.001
    These will go on forever unless you use DELPROF in your GPO as a Computer/Windows/Startup script to remove all "USER ONLY" profiles from the docs and settings folder. This works great other than now, users seem to randomly loose their favorites. This is about the most discussed roaming profile issue on the internet but not a single person nor group of persons has created a 100% working fix for it. It's been a massive headache for me and my guys and I know thousands of other IT guys have or are still struggling with it.
    PLEASE Microsoft, fix this winlogon issue so it will release the user profile directory when the user logs out. PLEASE.

Maybe you are looking for