Re: Mysterious revision date changes caused by Advanced Server?



In article <ahp412hn756osl3a7tef27gescie2d6rbf@xxxxxxx>, D Gillbilly <gillbilly@xxxxxxxxxxxxxxx> writes:
:My real problem is that something changes file revision dates.
...
:Now that it has happened on my development machine, I have
:debris that I can work with and a pretty good idea on how to
:cause the problem. I just need to figure out what security/auditing
:I need turned on to confirm my suspicions (I prefer books, so this
:can wait until I return to work).
...
:In the example below, the only file that should have changed
:was the text file, but something also revised the executables.
:The text file was put into that directory using "save as" from a PC to
:an Advanced Server (PATHworks) network share.

Are you sure that the Windows boxes involved are not infected with
something? Having something writing into Windows executables is a
common footprint for electronic vermin, of course.

Also, are you sure that whatever application you are using on the
Windows system itself isn't also somehow modifying these files or
the file headers.

I will assume the contents of the files are NOT changing -- though
if they are, do see the first paragraph, above.

Given what I've seen of directory operations, it also would not
surprise me to see the directory itself rewritten when something
was added to or changed within the directory -- directory shuffles
are fairly common on OpenVMS and on Windows, and it would not be
surprising to learn that some sequences involving Windows files
and directories stored on a remote server can and do lead to the
host server's associated file headers being modified.

You can see locality within the Windows directories using DUMP,
for instance -- the files aren't stored in any particular order,
so they can end up in odd clumps, depending on who wrote what
piece to do what when writing to the directories.

Not a big help, I know.


---------------------------- #include <rtfaq.h> -----------------------------
For additional, please see the OpenVMS FAQ -- www.hp.com/go/openvms/faq
--------------------------- pure personal opinion ---------------------------
Hoff (Stephen) Hoffman OpenVMS Engineering hoff[\0100]hp.com

.