Link to home
Start Free TrialLog in
Avatar of YRMC_Infrastructure
YRMC_Infrastructure

asked on

File Server

I am monitoring my files server for anyone deleting file but I don't know why user User: NT AUTHORITY\SYSTEM keeps showing deleting  files sqlserv.exe and copy.exe. I ran my virus and it came up clean


26 Dec 2012 05:57:44 PM Computer: [KFSH-CL-FLPD-02] Monitor: [Watch F:\] Description: The following activities have occurred:
Op: Deleted
File: F:\KFSHHomeFolders\MedApp\mimages\sqlserv.exe
User: NT AUTHORITY\SYSTEM
App: System or Network

Op: Deleted
File: F:\KFSHHomeFolders\MedApp\mimages\copy.exe
User: NT AUTHORITY\SYSTEM
App: System or Network
Avatar of Sushil Sonawane
Sushil Sonawane
Flag of India image

run the anitvirus scan on the system in safe mode then check
Avatar of YRMC_Infrastructure
YRMC_Infrastructure

ASKER

I ran it in safe and normal mode
ASKER CERTIFIED SOLUTION
Avatar of davorin
davorin
Flag of Slovenia image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Can you attach the files here to analyze?