|
We received an alert that several files had been deleted from the C:WindowsSyswow64 of a server early this morning. I can't verify if the files were actually gone as I didn't have the right folder options set when I looked at the folder. We later received a notification that files were created in the :WindowsSyswow64 directory. I believe the list matched the list of files that were reported as being deleted. We also received an alert that several services had changed startup type: Monitor: [Monitor services on SRMMAL1] Description: Service "Credential Manager" recently changed from startup type Manual to Boot Service "Desktop Window Manager Session Manager" recently changed from startup type Automatic to Boot I've looked over the server and didn't find any unknown processes or service running. I did a full manual virus scan and a full scan with Malewarebytes as well. They found no viruses or malware. Is this something maybe other customers have reported seeing in the past and found there is a known reason for these changes being made? The server is Windows 2008R2 Enterprise edition. Thanks |
|
Hi You should check to see if there was a Windows Update. Sometimes they can be the issue with the files in the WindowsSyswow64 directory being changed. As far as the change in the startup type you need to check to make that those services have the correct start up type. I'm guessing but it could be an update as well. Thanks Please make sure to mark your questions accepted when you have your answer by clicking the gray check mark to the left of the answer. |
