Hi all. Last week, one disk on the file server crashed. In Windows disk was RAW. It is a VMware virtual machine, and I simply created a new disk and restored the files from backup. However, users began to complain that PDF files were not opening, and many of them were missing, although the backup from 45 days ago had the same problems. The backup is done using Veeam Agent, and I don't think a virus could have damaged it.
In windows event log i found errors when backup start goes
PreFinalCommitSnapshots({5ad6f142-0c0e-48ec-8c84-ace3489d6ada}, 4) [hr = 0x8000ffff, Destructive failure].
Error context: CreateFileW(\\?\Volume{a4315ebe-b055-4ec0-8a93-3e63a65e7104},0xc0000000,0x00000003,...).
Veeam send Error
Creating VSS snapshot Error: Failed to create snapshot: Backup job failed. Cannot create a shadow copy of the volumes containing writer's data. VSS asynchronous operation is not completed. Operation: [Shadow copies commit]. Code: [0x8004230f].
Error: Failed to create snapshot: Backup job failed. Cannot create a shadow copy of the volumes containing writer's data. VSS asynchronous operation is not completed. Operation: [Shadow copies commit]. Code: [0x8004230f].
Now I don’t even know what happened. continue to explore
I additionally contacted the VEEAM forum and ransomware forum. But files have no file extensions or ransom notes. It will be difficult to detect, if it ransomware.
Help who knows what to find the reason please.