I disabled sophos on FS. On the corrupted file I found the following:
couldn’t check properties in explorer
couldn’t copy the file in explorer
couldn’t delete the file in explorer
couldn’t copy the file in a dos box
COULD delete the file in a dos box.
I then rebooted the server just to make sure it was happy.
It appears that if there is a high CPU utilization we should check what process is the highest. If it is sweep, check the last file it scanned – we might be able to use that to track down a corrupted file (if that is the problem). In this case “user” was the last user to have a file scanned, but it wasn’t the corrupted file.

I was hoping to be able to get a copy of the file and then place that on a test server to see if we could duplicate the error and see if there was another way to prevent the server from crashing, by disabling sweep w/o a reboot.