Sus activity on samba share (virus)

[Daniel_walmsley]

Hi
i recently found a file called test file and a file called windowsfw.exe (norton av detects this as W32.HLLW.Gaobot) on my password protected samba share.
i was wondering if samba generated any logs so i could track how the files were created

Thanks
Daniel walmsley

[RoadRunn]

All of samba's logs are in /var/log/samba. Depending on your configuration usually there is one log per client machine/ip, and then another log for the smbd daemon, and nmbd daemon. You can try checking those but unless you had a deep logging level turned on in the first place, this would be concidered a sucessful connection and not necessarily logged. Check out /var/log/samba files.