Kenneth Cochran's questions

Possible Duplicate:
Reinstall after a Root Compromise?

One of our servers was compromised after a user with administrative privileges accidentally loaded a virus from a USB drive on a desktop connected to the domain. The two most obvious symptoms of this were:

• The server is no longer responding to login attempts
• The root directory of the drive containing user data has been filled with randomly named empty folders. (Initially it was around a million folders, I've been slowly deleting them.)

I've run several virus scans from different vendors and am fairly confident the virus has been removed but the damage is done.

I'm hoping the two symptoms are related and that once the directories are gone the server will start responding again. The drive is very slow to respond. I'm deleting about 20k folders at a time. Anymore than that and windows explorer becomes unresponsive.

In the event that I finish cleaning up the HD and things don't return to normal what other things can I check?

The company I work for still uses Windows 2000 Server for most, if not all of its infrastructure. I recently joined my Vista laptop to the domain and noticed the system clock jumped ahead by an hour. I know the cause of this is because the time is synchronized with the domain server (which has dst turned off, because no one could get the patch working correctly after the law change a few years ago). I turned dst off on my laptop so the time would be correct. The problem I'm having is that every few minutes I see the clock jump ahead again, only to jump back a few seconds later. This is causing problems with a few programs I have that use the system time to determine if files need to be updated.

Any ideas on how to fix this problem? If I haven't given enough information to troubleshoot with let me know and I try to fill in the missing details.

Update

As I mentioned above I don't have access to the PDC or any of the other servers (nor do I want to be held responsible for the results if something gets messed up). For the time being I'm going to turn dst on my laptop back on and change my clock setting to a different timezone and see how that works.

I work part time as a network/system administrator for a small school. The school uses a commercial student information system that gets updated quarterly. After the server is updated users cannot access the SIS without an administrator manually running the update installer on each machine. Its been this way for as long as anyone can remember.

My predecessor(s) went to great lengths to lock down the desktops. I assume to try to prevent users from accidentally installing viruses and such (Their efforts failed I might add). This appears to be the reason the SIS cannot automatically update each desktop without an administrator logged in. After a recent update its become worse. Now users can't even use the program as normal without elevated privileges, let alone install updates.

Being unable to locate the setting(s) that are restricting the users, I've had to manually add each user to the administrators group for their own local machine. Of course, this means if one malfunctions that user can't use another user's machine until I get it repaired.

I'm assuming the security setting(s) I need to change are define in group policy editor but I can't seem to find where. Any help would be appreciated.

P.S. In case you haven't guessed, I'm not trained in Windows administration. I've learned enough by reading help files to get by but my day job is software development.

I work part time for a small private school. The 24 node computer lab kept having hardware failures (mostly drives and cooling fans) so I turned it into a Linux based thin client network. Although the workstations now boot from the network, most still have working hard drives. They also use only a fraction of their computing power to run an x server.

I'm looking for ways to but these computing resources to good use. Each workstation has a 40GB HDD, a Pentium 4 processor and 256M RAM.

I've considered:

• Installing a fault tolerant distributed file system on each of the workstations. This would make use of both the hard drive space and computing resources of each workstation and yet continued hardware failures would have minimal impact.
• Removing the hard drives and putting them in a couple of file servers. Running a distributed computing client on the workstations to take advantage of free CPU cycles. Ok, though I'm sure to find a place for a few more file servers, I'll admit I don't really have any application in mind for a distributed processing environment.

If you think the first idea has merit, I'd be interested in any information you can give on the various distributed file systems available. I did a bit of searching but couldn't find one that really fit the situation. I'm looking for redundancy and fault tolerance but it needs to have support for user and group level access restrictions as well.

Any other suggestions would be appreciated as well.

I'm attempting to give users a choice of customized UIs when they login. One will be a standard Gnome session. The other would be a custom UI. I'm not sure if its possible to base the custom UI off of Gnome at the same time or if it would be easier to use a separate desktop environment like KDE or XFCE and then customize it.

In any case the first hurdle is getting adding a new session to the login menu. Most desktop environments create one when their installed so going this route will create one automatically. If I try to reuse Gnome for the custom session I'll need to learn how to create a new session entry manually.

Anyone have any ideas?