I have win2000 servers running Active Directory in our company. I noticed group policy errors and file replication errors in event viewer. I have up todate sophos antivirus. I noticed the sysvol folder size range between 500 to 700 Mb on most of theservers, while on 2 of the servers the size of sysvol is 30-50 Mb only. When I ran fixnimda by symantec, w32.nimda.a@mm was detected but removal was unsuccessful. Manual deletion is not possible even in safe mode. The large sysvol folders are the ones infected. Sophos anti virus does not detect the virus iv sysvol folder.