Virus found while backups were being run

I RDP'd into my App server for my Intranet and found this lovely message waiting for me from Symantec:
Scan type: Auto-Protect Scan
Event: Risk Found!
Security risk detected: Bloodhound.Exploit.79
File: C:\Users\bkupadm\AppData\Local\Temp\WebTempDir\208C2ACC76734EE2AB31D0A273F5217B_1.tmp
Location: C:\Users\bkupadm\AppData\Local\Temp\WebTempDir
Computer: Server123
User: bkupadm
Action taken: Pending Side Effects Analysis : Access denied
Date found: Saturday, October 18, 2014 3:27:05 PM
I'm at a loss as to what to do with this. The Backupadm ID is the user ID that runs our Commvault backups. I've checked with them and they say that all SP cached data is written to the D:\, and that NO commvault data get's written to the C:\,
let alone C:\users.
I can't figure out what could be in the webtempdir folder because the backup account never logs in to the desktop. And the Exploit is a Powerpoint exploit, and we don't even have Office installed on these servers. I can't figure out how to go
forward with this. The Backup account has Full Read/Write access to the entire system, so I need to figure out what the virus is, and make absolutely sure that it's nowhere else in the system.
Any ideas would be most appreciated.
Ted

Hi,
Thank you for your question.
We are currently looking into this issue and will give you an update as soon as possible.
Thank you for your understanding and support.
Thanks,
Linda Li
Forum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]
Linda Li
TechNet Community Support

Similar Messages

MP Drivers An Error occurred while files were being copied 0001 0002

Afternoon,
Hope anyone can assist.
Okay here is a quick recap:
They did a system recovery on the laptop befor that the printer wasa working 100% after the recovery the printer did not want to work at all.
We have spoken to 5 different consultans from Canon. They say it is windows problem.
It does not install from canon links or CD what we have for the printer.
Canon Pixma MG2140
Here is the message it keeps repeating:
MP Drivers
An Error occurred while files were being copied 0001 0002
This is urgent as we have been struggling more than 3 Weeks.

Hi,
Do you have any anti-virus software installed? If you have, I would suggest you temporarily turn off these software, then try to install again.
And please do not connect the device to the PC until the driver installation is complete.
If the MP Drivers have been previously installed on the PC, unistall them first, maybe use the shortcut on the Start>Programs>Canon>MP Drivers menu, or via device manager, you can find instructions in Canon website.
Yolanda Zhu
TechNet Community Support

No OS X system backups were found?

Hi there,
I recently did the Mountain Lion -> Mavericks upgrade. Too late I discovered that sync between Outlook 2011 and Mail etc had been removed from Mavericks. That's a whole other story.
So I decided that I'd revert back to Mountain Lion from a Time Machine backup so I followed the instructions 'Command R' at startup and followed the bouncing ball only to get the message back "No OS X system backups were found".
From research it appears that this was a bug first disocvered in Mountain Lion.
I've been on Mavericks for over a week now and Time Machine backups appear fine in the 'Star Wars' view and a file level recovery works just fine.
So this morning I decided to see if system backups had corrected itself by restarting and doing Command R etc - nup, same message.
Anyone else experienced this and found a simple way of resolving the problem? I'm no longer going to revert to Mountain Lion but I would like the piece of mind that I actually have a full backup!
Cheers,
Jappas

This simple procedure will clear your Time Machine settings, including exclusions. The backups won't be affected. If you have a long exclusion list that can't be recreated easily, you may prefer a more complicated procedure that preserves the exclusion list. In that case, ask for instructions. Otherwise, do as follows.
Triple-click anywhere in the line below on this page to select it:
/Library/Preferences/com.apple.TimeMachine.plist
Right-click or control-click the highlighted line and select
Services ▹ Reveal
from the contextual menu.* A Finder window should open with a file selected. Copy the file to the Desktop. Then move it (the original, not the copy) to the Trash. You'll be prompted for your administrator password. Reboot and recreate your settings in the Time Machine preference pane. It will show that you have no backups. Don't worry; your backups haven't been touched. Run a backup to test. The backup may take much longer than usual. If TM now performs as expected, delete the file you copied to the Desktop.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combinationcommand-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar, paste into the box that opens (command-V). You won't see what you pasted because a line break is included. Press return.

My MacBook w/ OSX 10.6.8 cannot access my external Time Machine Backup USB Drive. It says it is a Read Only drive. When I went to change permissions I found all pernissions were listed as "Custom" and I could not reset them to "Read Write". Any help!

My MacBook w/ OSX 10.6.8 cannot access my external Time Machine Backup USB Drive. It says it is a Read Only drive. When I went to change permissions I found all pernissions were listed as "Custom" and I could not reset them to "Read Write". Any help would be appreciated.

This can be done easily with ethernet.
Please follow the instructions strictly.
To make it easier I want you to do this overnight so you can turn off all your current connection to the internet.
Just go to the airport fan in to the top right and turn airport off.
Get ethernet cable and connect the laptop to the TC lan port.. ie <-> ones.
Press and hold the reset on the TC for about 10sec. until the front led flashes rapidly.
Open the airport utility.. go to manual setup and change the wireless to off. (so other people around you cannot join your network of one).
Ignore all the errors.. they won't stop the backup working.
Go to the TM and reselect the backup target disk as the TC.
It should start after 2min and run through to completion.
That is it.. for a backup of many GB it might take a few hours.. so make sure the laptop has power plugged in and the sleep is off.. (on early ones I think this is needed but I am a late arrival to the scene).. sleep doesn't affect later OS.

Can't save BISM file pointing to excel sheet (data source). ErrMsg: "There were errors found while validating the page: Cannot connect to the server or database."

Hi,
Me and a collegue is administrering our new enterprise BI portal in SharePoint 2013 (On Premise) and have a problem with using a specific Excel file including general ledger data as data source through a BISM file.
This particular BISM file can't be saved without getting the error message "There were errors found while validating the page: Cannot connect to the server or database."
BISM files against other Excel sheets and sources (for example SSAS tabular databases) works well.
Can anyone help us pinpointing whats wrong here, this is a really important stakeholder in our organization requesting this reporting?
Cheers!

Hi E.SWARD ,
My self created a Power pivot excel then i want to use this excel to create BI file . Still i am getting the same error . Pls help me to resolve this issue
Cannot connect to the server or database.
I am getting the similar error , if i use Tabular analysis server instance .
Subhash

Does anyone know of a VI or how to go about writing one that will prevent the computers time/date from being disabled while an application is running.

Does anyone know of a VI or how to go about writing one that will prevent the computers clock/time from being disabled while an application is running. The time and date can normally be reset while an application is running by clicking on the time/date in the lower right-hand corner of the computer screen. I have an application that runs over several days and it is critical that the time and date of the computer not be changed. Is there an easy way to lock this out from the user? Note that I am what I consider an advanced beginner in LV.
Thank you,
Chuck
Solved!
Go to Solution.

That is not something you can do from LabVIEW, as it is an operating system operation, and it will depend on the operating system that you're using. On Windows you can use a group policy to control this. Please Google on "prevent time and date change in windows".
Also, please try to refrain from stuffing your entire message in the subject block. Keep the subject short, but descriptive enough so it can be understood what you are basically asking. Thanks.

I just got an IPAD2 on Saturday. With the Mac, I could always tell when programs were open/running by going to the menu bar. How can I tell what programs are running in the background. I am struggling with not being able to go to a menu bar at the top

I just got an IPAD2 on Saturday. With the Mac, I could always tell when programs were open/running by going to the menu bar. How can I tell what programs are running in the background. I am struggling with not being able to go to a menu bar at the top

You can see which apps are open and/or recently used by double-clicking the home button to bring up the taskbar at the bottom of the screen (not all apps that appear there are active) - you can then close apps on it by pressing and holding one of them for a couple of seconds or so until they start shaking, then press the '-' in the top left of the Mail app to close it, and touch any part of the screen above the taskbar so as to stop the shaking and close the taskbar. If you have an app 'open' on-screen then it won't appear on the taskbar, you will need to go back to the homescreen first, and it should then show when you next open the taskbar.
If you haven't already got a copy then you can download the iPad manual from here : http://support.apple.com/manuals/#ipad

One or more errors were found while trying build the realse version

While i am generating .ipa file i am getting another error mentioned below.
One or more errors were found while trying build the realse version
Packing error while generating .ipa file for iphone.

This is a forum for Adobe Acrobat Froms not the Flash/Flex product.

Virus Found error message while uploading document in Document Library

Hi,
When uploading documents into the document library, I got a message "Virus Found" ERROR message.
the installed virus scanner is urrently unavailable.If the problem persists, please contact your administrator.
How to resolve this issue? its in staging environment. in our test environment we never received this error message while uploading the message.
help is appreciated.

hi
have you installed an antivirus app on server?
Check this link
https://support.microsoft.com/en-us/kb/2953311/
Romeo Donca, Orange Romania (MCSE, MCITP, CCNA) Please Mark As Answer if my post solves your problem or Vote As Helpful if the post has been helpful for you.

SQL*Plus Change to File While Being Run

Anyone,
Once you execute a file run in SQL*Plus does the entire file get cached by SQLPlus? (i.e. @C:\temp\myfile.sql)
If I change the file C:\temp\myfile.sql while the session is running (long runing script) will it take effect or not?
I was able to open the file make a change and save but not sure if SQLPlus will pick up my change when it gets to the point in the script where I made the change. Since it was already running.
Thanks,
Miller

That is a very bad idea to begin with.
If you made a change at the location that has not yet reached by the SQL*Plus script processing, you could see those changes (again depending upon where and how you do them).
But in most circumstances, the results will be unpredictable (most likely with error messages) since you cannot control what part of the script the SQL*Plus application is currently executing at the moment you decide to make change to the script.
For example, I started with this script:
REM --- Script start ---
prompt "Waiting ..."
begin
dbms_lock.sleep(20) ;
end ;
begin
dbms_output.put_line('This is text') ;
end ;
prompt "Finished..."
REM --- Script end ----And run this within SQL*Plus. While the PL/SQL block was waiting on the sleep call, I removed the first line of the script (the one that starts with the prompt statement) and saved it. Below is the output from this run:
SQL> @test
"Waiting ..."
PL/SQL procedure successfully completed.
SP2-0734: unknown command beginning "ut_line('T..." - rest of line ignored.
SP2-0042: unknown command "end " - rest of line ignored.
PL/SQL procedure successfully completed.
"Finished..."
SQL>I would not consider this as a successful completion of the script.
At this point, you are probably playing with probability and taking chances.
Message was edited by:
Kamal Kishore

[SOLVED] Backing up the system while the system is running?

Is it ok if I backup the system while it's running? Or does it *have* to be done from a LiveCD?
I was thinking of using this:
$ sudo rsync -avx /* /mnt/Backup --exclude={/dev/*,/proc/*,/sys/*,/tmp/*,/run/*,/mnt/*,/media/*,/lost+found}
Rsync will complain at the end that "some files/attrs were not transferred", but the backup works fine (as far as I can tell).
Should I add "[...] > sometextfile.txt" at the end, to see which files weren't transfered right? Has anyone else done something like this before?
Last edited by DSpider (2012-06-14 15:56:03)

DSpider wrote:Rsync is not necessarily better, but it does the job. I'm planning on transferring the system to a loopback device (a raw .img file) which will serve as a container for chrooting, and later converting to .vdi for use in VirtualBox. It's a fun project I'm working on: "Moving an existing Arch install to VirtualBox" (title in progress). Maybe I'll write a wiki article, since I did it three times already... And it works, even if I back them up while the system is running. I was just wondering what those files were.
Oh, alright. Cool. Yeah, I just wanted to check whether there was any important differences between tar and rsync. I think I'll check the wiki and do some reading about the two, but from the sound of it, it sounds more like a matter of preference than anything else, which is groovy.
Last edited by lspci (2012-06-13 15:08:01)

Windows Server Backup scheduled task run successfully but backup do not start (not running) on Windows Server 2012

Hi,
A backup job has been setup on Windows Server 2012 (Platform: Win32NT; ServicePack: ; Version: 6.2.9200.0; VersionString : Microsoft Windows NT 6.2.9200.0) via Windows Backup Software UI (Local Backup 1.0).
It is appearing as a scheduled task "\Microsoft\Windows\Backup\Microsoft-Windows-WindowsBackup" belonging to user 'nt authority\system' in task scheduler.
The problem is that the Backup job never start despite the scheduled task running and completing successfully (when run automatically or manually)!
Would you be able to explain why and assist in resolving that issue?
Here is what we know:
When the backup is run manually via the Windows Backup Software UI, it works fine.
When the backup is run via command line (as set in schedule task) in a cmd command prompt (as local/domain 'administrator' or as 'nt authority\system' which is possible by running command prompt via 'PsExec.exe -i -s cmd'), something like "%windir%\System32\wbadmin.exe
start backup -templateId:{f11eb3aa-74e7-4ff4-a57b-d8d567ee3f77} -quiet", it works fine.
If you manually run the preset scheduled task while logged in as administrator, the task run and complete successfully but the backup job does not start.
Idem if you schedule task is run automatically at scheduled time.
The schedule task run and complete successfully but the backup job does not start.
It is confirmed by running the following in a command prompt as 'nt authority\system':
schtasks /run /tn "\Microsoft\Windows\Backup\Microsoft-Windows-WindowsBackup"
SUCCESS: Attempted to run the scheduled task "\Microsoft\Windows\Backup\Microsoft-Windows-WindowsBackup".
Despite success result, the Backup job does not start running...
No errors or warning appears anywhere in Event Logs (Microsoft > Windows > Backup or Task Scheduler) nor in the scheduled task History tab. The schedule task complete successfully but no Backup job is run...
If scheduled task automatically set by Windows Backup software is duplicated (copied) and set manually it runs fine as 'administrator' and as 'nt authority\system' (subject that 'nt authority\system' is added to the 'Backup Operators' AD group).
Here is an export of the current pre-set schedule task, is there any settings that need to be changed to make it works?
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
    <Author>MYDOMAIN\SERVER1</Author>
    <SecurityDescriptor>D:AR(A;OICI;GA;;;BA)(A;OICI;GR;;;BO)</SecurityDescriptor>
</RegistrationInfo>
<Triggers>
    <CalendarTrigger id="Trigger 1">
      <StartBoundary>2014-07-14T21:00:00</StartBoundary>
      <Enabled>true</Enabled>
      <ScheduleByDay>
        <DaysInterval>1</DaysInterval>
      </ScheduleByDay>
    </CalendarTrigger>
</Triggers>
<Principals>
    <Principal id="Author">
      <UserId>S-1-5-18</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
</Principals>
<Settings>
    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>true</StartWhenAvailable>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <StopOnIdleEnd>false</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
    <UseUnifiedSchedulingEngine>false</UseUnifiedSchedulingEngine>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>P3D</ExecutionTimeLimit>
    <Priority>7</Priority>
</Settings>
<Actions Context="Author">
    <Exec>
      <Command>%windir%\System32\wbadmin.exe</Command>
      <Arguments>start backup -templateId:{f11eb3aa-74e7-4ff4-a57b-d8d567ee3f77} -quiet</Arguments>
    </Exec>
</Actions>
</Task>
Thank you in advance for your feedback.

Once again, the issue is not to run the backup manually from the command line but to have it run via the scheduled task setup by the Windows Backup software.
By default, the schedule task is to be run as NT Authority\System, and when run under this account, the backup does not start (even though account is member of Backup Operators) and job can manually be run via elevated command prompt. This is not a normal
behavior and constitute a major bug in Windows Server 2012.
From my understanding the NT Authority\System account is a built-in account from Windows that should by default be part of the Administrators group (built-in) even though it does not explicitly appears like it in AD by default.
This account shall have by default Administrators rights and Backup Operators rights (via the Administrators group) without being explicitly added to those groups (http://msdn.microsoft.com/en-gb/library/windows/desktop/ms684190%28v=vs.85%29.aspx). By design
it is supposed to be the most powerful account which has unrestricted access to all local system resources. If that is not the case (as it seems) then this would constitute a major bug in Windows Server 2012 edition.
As said previously and as you confirmed, currently by default NT Authority\System on Windows 2012 server cannot start backup manually via an elevated command prompt unless it is manually added to Backup Operators (or Administrators) group. But wouldn't that
constitute a bug of Windows Server 2012?
Our server has not yet been restarted since I added NT Authority\System account to the Administrators group explicitly manually so I cannot yet confirmed it would sort the issue. Indeed it is heavily in use so cannot easily be restarted. Will confirm when
done.
We also have an additional problem where after a while of last reboot, part of the Exchange ECP can no longer be properly loaded in the web browser due to compilation error (compilation is done via NT Authority\System account which seems to no longer have
sufficient right to compile .NET code). What is strange is that it works at first and then stop working at some point... I am hopeful that adding NT Authority\System to the Administrators group would sort this issue as well but once again, that shall not be
needed!!!
Could a Windows Server 2012 update introduced some security policy changes or else that prevent NT Authority\System to have full power?

An unexpected error occurred while the job was running. (ID 104 Details: The parameter is incorrect (0x80070057)) After DPM 2012 SP1 to R2 Upgrade

Hi,
We have upgraded DPM 2012 SP1 to DPM 2012 R2 and OS is Windows 2012 standard.
Now in File Protection Group, we receive error
"An unexpected error occurred while the job was running. (ID 104 Details: The parameter is incorrect (0x80070057))".
This happens to only one Drive(X: Drive) of the PG server, other drive(Z: Drive) backup is working fine.
We tried,
Deleted entire protection group and recreated ,
Ran consistency job 2 to 3 times.
Ran Synchronize with consistency check.
But every time It failed. Before upgrade it was working fine.
Thanks

Hi
I would suggest opening a new case with MS to allow the DPM team to further look into the issue. Also the DPM 2012 R2 RollUp which addresses the (0x80070057)
issue is Rollup 1 and the private will not be needed after applying Rollup 1. The Roll up is found here
http://support.microsoft.com/kb/2904687/en-us
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your
question. This can be beneficial to other community members reading the thread. Regards, Dwayne Jackson II. [MSFT] This posting is provided "AS IS" with no warranties, and confers no rights."

[Xcode] Error from Debugger: Program not being run

All of a sudden my Cocoa-AppleScript projects are not being run with *Build and Run* in Xcode 3.2.2. Well, most of them anyway - some old, and some downloaded projects are OK, but projects that ran OK yesterday give me an error today:Running…
No executable file specified.
Use the "file" or "exec-file" command.
No executable file specified.
Use the "file" or "exec-file" command.
The program being debugged is not being run.
The program being debugged is not being run.
No project settings were changed (I don't even use the debugger, just the console), and the only thing that I've done in the mean time is a software update. The only thing new from that was a Java update, which I don't think should have had anything to do with it. I was having the same problem even building new blank projects, but I've since updated to 3.2.4 and reset the Xcode preferences, which at least got the blank projects going again.
I've compared some of the settings between projects that work and projects that don't, but I have no idea what to look for. The built applications will run when double-clicked by themselves, just not in Xcode.
Update: zipping the project files and then unzipping them seems to fix the issue, but I would like to know what to look for that could have caused this problem.

AHA! Well, although I could have sworn I ran some of these projects from their current location, the problem wound up being related to characters in the name of one of the containing folders.
I sometimes use leading spaces in the folder names to get them to sort to the top of the list, but even doing that you sometimes need to use additional characters to get the items to sort in the desired way. One of the characters I used (a tilde) seems to get expanded by one of the underlying utilities - my archived projects were in this folder, while other downloaded examples (and copies I had made to other locations) worked since they were outside of the problem folder. It was weird that pretty much everything else ran correctly, though.
Lesson learned - do NOT use characters that may be special to a shell script in any of your project file paths.

"Virus found" by macupdate . com. Is it a valid Apple site?

In Safari, I typed in a new (to me) website address. Immediately after hitting 'enter' a window popped up saying:
http : / / macupdate . com - apple . menu (I put the spaces in so it wouldn't become a hot-link)
VIRUS FOUND
The last website you visited has infected your Mac with a virus.
Press OK to begin the repair process.
There is no other option than to press OK but being a sceptic I force quit Safari and turned off the Mac Pro. Later when I turned it back on and tried to open Safari the same window popped up again. Is this a valid Apple site or is a hacker fishing? If it is a hacker, how do I get past the "press OK" window safely?
Thanks for any help.

It's not a virus. It's a Web scam that only affects your browser, and only temporarily. There are several ways to recover.
1. Some of those scam pages can be dismissed very easily. Press the key combination command-W to close the tab or window. A huge box will pop up. Press the return key and both the box and the page will close. If that doesn't happen, continue.
2. Press and hold command-W. You may hear repeating alert sounds. While holding the keys, click the OK button in the popup. A different popup may appear, which you can cancel out of as usual.
3. From the Safari menu bar, select
Safari ▹ Preferences... ▹ Security
and uncheck the box marked Enable JavaScript. Leave the preferences dialog open.
Close the malicious window or tab.
Re-enable JavaScript and close the preferences dialog.
4. If the Preferences menu item is grayed out, quit Safari. Force quit if necessary. Relaunch it by holding down the shift key and clicking its icon in the Dock. None of the windows and tabs will reopen.
After closing the malicious page, from the menu bar, select
Safari ▹ Preferences... ▹ Privacy ▹ Remove All Website Data
to get rid of any cookies or other data left by the server. Open your Downloads folder and delete anything you don't recognize.

Virus found while backups were being run

Similar Messages

Maybe you are looking for