We've been having Backup Exec issues related to a corrupt file within SYSVOL on an SBS 2008 server. An anti-virus scan removed a file (the same one BE was failing on) from within the scripts folder as a trojan.

The following files are still in the scripts folder, and I've not seen anything similar in the same location on any of our other SBS 2008 servers so I'm tempted to just delete them as being related to the trojan.

enter image description here

Would you recommend removing them or leaving them? I can post their contents if that would help.

2 Answers 2


It appears some bits have been flipped in those files' names. Whether this was because of the trojan or not, it's difficult to say. But given the names of the files, it's very unlikely that they have any particular importance, or if they do, they are easily replaced.

  • I'll leave it a while (backing up successfully) then see about moving them before eventually deleting. Thanks May 2, 2013 at 15:53

That looks like a potentially hardware-- disk controller, cabling, controller cache RAM, or system RAM, or me. I'd get that data backed-up ASAP, verify the integrity of the backups, and start looking for hardware problems. (Don't just verify that the backups match the files on disk, either-- actually verify the integrity of the files. ZIP files can be tested, database files can have their structure checked, etc. If you've got a hardware problem randomly flipping bits on your disk you're going to have problems.)

Being that those files are in the SYSVOL they may have replicated from another DC, too. If you have a single DC then the provenance of the files isn't in question, but if you have multiple DCs you need to check them all out.

  • I'll check the backups and take a look at the whole storage subsystem. Thanks May 2, 2013 at 15:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .