MSSQL$SHAREPOINT Error 18053

HCHTech

Well-Known Member
Reaction score
4,157
Location
Pittsburgh, PA - USA
I have a small office customer, single server running SBS2011. They use exchange and have a single share file directory on the server. They do not use Sharepoint.

They called today because their shared folder was "corrupted". After remoting in, I find that there are dozens of folders in that directory using names like

{00360482-9371-9360-8260-715936049269}

Hmm. Inside of these folders are normal subfolders and data files (word docs, spreadsheets, etc). Also, there are many new shortcuts in the shared folder. The shortcut has the original folder name, i.e. Smith Chemicals, and the shortcut points to one of the numeric folders. There are also many shortcuts that point to numeric folders that do NOT exist in the shared folder, as if they had been deleted.

So this is weird - some kind of corruption somewhere, or process run amok. In the application event log, I find thousands upon thousands of MSSQL$SHAREPOINT Error 18053s. Occurring several per second back to 4:am yesterday. Note that the customer reports their shared folder looked and acted normally this morning, but was corrupted when they came back from lunch. The errors were numerous that they filled the entire log, so I can't look before yesterday for clues.

For the moment, I've stopped the sharepoint services, which stopped the deluge of errors in the application log. I also went through their backup to make sure last nights version of everything was available (it was - Phew!).

Googling around on this error did not product a direct hit or obvious required action or cause. I'm going to reboot the server to see what happens from there. Has anyone come across this kind of behavior before? The server was up a long time, about 4 months, so maybe some resource ran too low or something.

They are solely a break-fix customer and not on my monitoring (they might be tomorrow, though) so I don't really have any additional information about the problem.
 
Hmm that's a thought. I rebooted the server without incident and no more errors are being posted to the logs with sharepoint running. They use TimeMatters, and I can see that database is 1.5GB. If I connect to the Sharepoint database, there are four entries. AdminContent is 108MB, ConfigurationDatabase is 150MB, ShareWebDB is 27MB, and WSS_Search is 442MB. I'm no SQL expert, but none of those seems out of whack.
I'm running a full virus scan now just so I can sleep better - maybe it just needed a good reboot...
 
Well - it turned out they had a Klez worm! When was the last time you ran into one of those - 2004 maybe? Unfortunately there was no AV on the server (of course there is now), so it had it's way for a while. This customer came with the new business and the former tech didn't believe in AV on the server in general. I am not in that camp, so my next task is going through the rest of the new customer base to identify any other unprotected servers.
 
Back
Top