Hello, all.
This SBS2000 system has about 15 users, and the URLSCAN.yymmdd.LOG file is
usually empty or contains obvious entries. However, I've noticed lately
some regular entries that I can't account for.
Two workstations are involved. Every day, at 2:15 AM, one client's inside
IP address is listed as the source for these in the URLSCAN log:
Raw URL='/COMPANY.bat'
Raw URL='/COMPANY.cmd'
Raw URL='/COMPANY.exe'
Raw URL='/COMPANY.com'
Raw URL='/COMPANY.bat'
Raw URL='/COMPANY.cmd'
Raw URL='/COMPANY.exe'
Raw URL='/COMPANY.com'
Raw URL='/CLIENT%20FILES.bat'
Raw URL='/CLIENT%20FILES.cmd'
Raw URL='/CLIENT%20FILES.exe'
Raw URL='/CLIENT%20FILES.com'
The other workstation is listed as the source for these, always at 2:30 AM:
Raw URL='/Client%20Files.bat'
Raw URL='/Client%20Files.cmd'
Raw URL='/Client%20Files.exe'
Raw URL='/Client%20Files.com'
There is a mapped drive from every workstation to a share on the SBS machine
called "\\servername\Client Files", and COMPANY is a sharename on the SBS
that may be mapped on the workstation that is issuing those commands. I
certainly don't know what the BAT CMD EXE COM series means except it looks
like it's looking for something to run.
There's no untoward behavior on the network or any of the workstations
(including these), so I suspect this is something benign.
Can anyone explain where this is coming from?
Thanks.