On Mon, Jun 7, 2010 at 8:58 PM, Mike Gill <[email protected]> wrote: > When I rebooted the server the RAID > must have corrected the discrepancy by deleting the cmd2.exe file that only > existed on one of the two drives housing the OS. Doh…
Actually, the OS just happened to look at the other disk. You've modified the filesystem of one disk without updating the other. Your mirrors are now out-of-sync. Should the system ever chance to read from the disk you modified, your filesystem will likely be corrupted. The system is now a ticking time-bomb. Break and re-create the mirror. Or just wipe the whole system and reload from scratch, like Rich Stovall says. The symptoms you described earlier do have all the classic earmarks of a rootkit or other system compromise. Sorry to be the bearer of bad news. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
