How to run full edit in Samba to identify where .scr files come from

now that I have managed to get access via SSH.

I want to create a log file, where I can see which process is creating .scr file , which are identified by Avira Security as a virus. These files reappear frequently.

I found following code at

 vfs objects = full_audit 
 full_audit:failure = none 
 full_audit:success = mkdir rename unlink rmdir open pwrite 
 full_audit:prefix = %u|%I|%m|%S

Does this code creates a log file in the samba directory?
I will now try to check , how I can copy files in SSH. Editing with Notepad++ would be preferred related to vi.

Any support appreciated…


Hi @Joerg70 ,

Please contact the WD Technical Support team for best assistance and troubleshooting:

Hi @Keerti_01 ,
would they support even if guarantee is outdated and the issue is not direct in responsibility of WD ?

I have now just searched the disk via SSH and deleted all photo.scr and disabled all FTP connection. (There is another thread from me)

I will observe if these files reappear.