How did this get on my network?

Dragonsi · #1 (**permalink**) 09-02-2005, 10:59 AM

Hi all,

2 days ago I noticed a shortcut in 'My Network Places' under the Internet category that leads to an offical goverment site (which I shall not name at this stage).

At first I thought very little about this until yesterday when one of my admin team (who works remotetly from their home) said they found the same link.

How are these links placed on my computer?
Can they be harmful?
Is this organisation tracking our activity?
How can I stop them from happening again?

PS - we recently had a disagreement with this organisation which lead to a major event being cancelled due to their costs. As a result of this, the national press picked up on the story and backed our side, giving this org some bad press. So if they are tracking our activity, I would not be surprised.

wrmineo · #2 (**permalink**) 09-02-2005, 06:00 PM

Contact your ISP, Internet Service Provider, and tell them of the situation.

nottheusual1 · #3 (**permalink**) 09-02-2005, 06:24 PM

I'm not aware of anything that, as a habit, can automatically populate your "My NetworK folder.

I'd start with a virus scan and a double-check of my firewall. Use a remote product like Trend so you aren't potentially using defeated anti-virus protection until you know for sure. If you are really paranoid (and it isn't a bad thing), there is some newer stuff about to look for root kits, etc. on PC's

Sounds nefarious, but my bet is that it is coincidental - you may have both done the same thing to create the shortcut and not realized it. M$ stuff does some pretty inexplicable things sometimes.

It would be pretty difficult to pick out two machines at disparate locations, hack the firewalls, beat the anti-virus and not leave a trail.

Unless you pissed off MI-5 or the CIA or something...........

If you did, disregard this post <<chuckle>>

Dragonsi · #4 (**permalink**) 09-04-2005, 07:35 PM

Thanks both for your reply, and no - they are not as big as MI5 or CIA... :)

I have recently upgraded the network in our office and added a new firewall/router, for a few mins every now and then last week, the firewall may of been down. So this might explain a possible intrusion on my network, that could of spread to the other remote pc, but all other pc's seem to be uneffected (mainly because they are used for testing and not real admin work).

My MD has called the org concerned to enquire about the link found, their answer was must of been there all the time....? :O

I have now set-up a full IP log on the main routers firewall and will check it everyday for activity. I'll let you know my findings...