Virus? Anyone have other thoughts?

[finco]

We have 40 users using the desktop client. Just under two weeks ago, we started experiencing file deletions from our windows server. The odd thing is that we might lose 10, 20 or 60,000 files but all directories are left intact. Given the speed of the deletions, this has to be a script based process. After matching the last time period for deletions with the owncloud log on the server, it appears that we have identified the machine causing the deletions but we do not yet have a cause.

Neither Microsoft Defender, Malwarebytes nor eset have identified a virus. Has anyone experienced this in the past and if so, did you ever find the cause?

[michaelstingl]

Sounds like a malfunction in the 2.7.2 version. Please upgrade to 2.7.6. Better also create the configured accounts from scratch. (there might be remaining errors in the applications SQLite database)

[finco]

Thank you. The user is already using 2.7.6 (sorry, I should have mentioned that earlier - server is 10.5).

Is there a known malfunction that causes this behaviour?

[eneubauer]

Perhaps the user has some other secondary installation, which is still accessing the instance?

Have the user check their personal security page:

I’ve highlighted the ownCloud client version string (and censored the domain).

[finco]

Thank you. Here is a subset of what I see on the effected users’ account. There are about 30 of the lines in total. I’m not exactly sure what I should be looking for.

[eneubauer]

@finco

I’m not exactly sure what I should be looking for.

If there is still one that is connecting with the old version (2.7.2)
Currently it seems like they are all with the new version.

[finco]

There are some connecting with 2.75. I assume I should delete them?

[finco]

Also, can you please explain what’s happening in OC when it thinks two clients are running and why that results in file deletions?

Thank you so much.