Recycle bin mega-weirdness

Hi folks,

A very weird recycle bin related thing happened to me and a couple of other folks at work today. Certainly one of the weirdest software-related things I've come across, and I have no idea how to begin to try and explain it. If anyone has had similar experience I'd be very interested to hear about it. Here's what happened.

One of my colleagues sent out an email to all, saying that at around 10 a.m., a whole load of files, from a variety of locations on his hard disk, had ended up in his recycle bin without his deleting them. (How he established this I do not yet know). He invited other people to check if anything similar had happened to them. I was sceptical, but by coincidence I had been chatting to someone else before I saw the email, who alerted me to the email and encouraged me to check, because he claimed the same had happened to him in December. So I checked. My recycle bin contained over 1500 files, from a variety of locations on my hard disk, all deleted in the space of 4 minutes between 10:10 and 10:14, not by me. A third colleague discovered nearly 2500 files in his recycle bin, again all deleted within a few minutes, not by himself, about half an hour before mine. At the moment, as far as we know, we three are the only ones affected on a site of over a hundred networked users.

I did a bit of homework and learned how to get a text file listing all the filenames and original locations for forensic purposes, before restoring everything.

I have tried Googling but it's difficult to know what the appropriate search terms might be ...

I'm not seeking technical assistance - in this situation, I'm a user (albeit, a geeky one), and investigating the incident is someone else's responsibility - but a) I am rabidly curious to know what on earth might have happened, and b) it seemed worthy of bringing to a wider audience. The potential implications are rather startling if this sort of thing started to happen on a regular basis.

Would anyone care to offer opinion, experience or wild speculation?

Andy

 

My first thought is a virus/malware. My second thought is that maybe there's some type of 'maintenance' software installed that automatically moves files to the recycle bin after 'x' number of days of inactivity on the files. It could also be some type of corruption, but that seems unlikely. I would check the 'last accessed' dates on the files in question. If they all have dates close to each other, or are of the same/similar type or location, then we know it's probably the "maintenance" software. If they appear to be random dates from random locations or random file types, then I'd say a virus is probably at work, or someone has maybe hacked your workplace network.

 

Hi,

Thanks for your thoughts. All the PCs are running Norton Security so if it it is virus/malware, it's recent or stealthy or both. My instinct is not - partly because of Norton, partly because computer weirdness is often just that, with no malice aforethought, but mainly because if I was going to write a virus to nuke people's files, I think I'd do a proper job and not just lamely move them to the recycle bin! That's a bit too civilised for a virus :-D

We do have software called Vice Versa but its job is to mirror the local hard drive to a network drive. We don't have any software to "clear out the dead wood" that I am aware of. Or rather, we use Lotus Notes which housekeeps its email database, but that's not the same thing at all.

I've restored the files now so I don't think I can check the last accessed dates - that information did not not seem to be captured either in the plain command line listing (which gives a date, but I think its file creation date, and renamed name) and the hidden info file listing (which gives original file name and path).

Anyway, I am off to work shortly, so we shall see what, if anything, transpires. Watch this space!

Andy