Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

File Server

Posted on 2012-12-26
4
Medium Priority
?
327 Views
Last Modified: 2012-12-28
I am monitoring my files server for anyone deleting file but I don't know why user User: NT AUTHORITY\SYSTEM keeps showing deleting  files sqlserv.exe and copy.exe. I ran my virus and it came up clean


26 Dec 2012 05:57:44 PM Computer: [KFSH-CL-FLPD-02] Monitor: [Watch F:\] Description: The following activities have occurred:
Op: Deleted
File: F:\KFSHHomeFolders\MedApp\mimages\sqlserv.exe
User: NT AUTHORITY\SYSTEM
App: System or Network

Op: Deleted
File: F:\KFSHHomeFolders\MedApp\mimages\copy.exe
User: NT AUTHORITY\SYSTEM
App: System or Network
0
Comment
Question by:YRMC_Infrastructure
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 18

Expert Comment

by:Sushil Sonawane
ID: 38721405
run the anitvirus scan on the system in safe mode then check
0
 

Author Comment

by:YRMC_Infrastructure
ID: 38721466
I ran it in safe and normal mode
0
 
LVL 27

Accepted Solution

by:
davorin earned 1000 total points
ID: 38721500
This is happening in the same folder (I guess) of some medical imaging application.
Is it possible that this is normal behavior for this application?
Application when needed creates/copies this two files and when the procedure is finished the files are deleted.

You can try to use process monitor to get some more details on which process is playing with this two files.
http://technet.microsoft.com/en-us/sysinternals/bb896645
0
 
LVL 5

Expert Comment

by:Imran Saeed
ID: 38723473
Can you attach the files here to analyze?
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
It’s been over a month into 2017, and there is already a sophisticated Gmail phishing email making it rounds. New techniques and tactics, have given hackers a way to authentically impersonate your contacts.How it Works The attack works by targeti…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

610 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question