Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We've been having Backup Exec issues related to a corrupt file within SYSVOL on an SBS 2008 server. An anti-virus scan removed a file (the same one BE was failing on) from within the scripts folder as a trojan.

The following files are still in the scripts folder, and I've not seen anything similar in the same location on any of our other SBS 2008 servers so I'm tempted to just delete them as being related to the trojan.

enter image description here

Would you recommend removing them or leaving them? I can post their contents if that would help.

share|improve this question

2 Answers 2

It appears some bits have been flipped in those files' names. Whether this was because of the trojan or not, it's difficult to say. But given the names of the files, it's very unlikely that they have any particular importance, or if they do, they are easily replaced.

share|improve this answer
    
I'll leave it a while (backing up successfully) then see about moving them before eventually deleting. Thanks –  Miles Hayler May 2 '13 at 15:53

That looks like a potentially hardware-- disk controller, cabling, controller cache RAM, or system RAM, or me. I'd get that data backed-up ASAP, verify the integrity of the backups, and start looking for hardware problems. (Don't just verify that the backups match the files on disk, either-- actually verify the integrity of the files. ZIP files can be tested, database files can have their structure checked, etc. If you've got a hardware problem randomly flipping bits on your disk you're going to have problems.)

Being that those files are in the SYSVOL they may have replicated from another DC, too. If you have a single DC then the provenance of the files isn't in question, but if you have multiple DCs you need to check them all out.

share|improve this answer
    
I'll check the backups and take a look at the whole storage subsystem. Thanks –  Miles Hayler May 2 '13 at 15:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.