File corrupted by some tools (probably virus or antivirus)- does the pattern indicate any known corruptions?

Question

As part of our software we install postgres(windows). In one of the customer sites, a set of files got corrupted. All files were part of timezone information(postgres/share/timezone). They are some sort of binary files.

After the corruption, they all starts with following pattern

od -tac output

$ od -tac GMT
0000000 can esc etx sub nak dle  em   |  nl  em  so   |   o   r   l   _
        030 033 003 032 025 020 031   |  \n 031 016   |   o   r   l   _
0000020   \   \   \   \   \   \   \ del   3  fs   ] del del del del del
          \   \   \   \   \   \   \ 377   3 034   ] 377 377 377 377 377
0000040   > ack   r   v   s ack   p soh   q   h   r   s   q   w   h   q
        276 206 362 366 363 206 360 201 361 350 362 363 361 367 350 361
0000060   t   r ack   h eot   s   }   v   h   | etx   p eot ack nul   }
        364 362 206 350 204 363 375 366 350 374 203 360 204 206 200 375
0000100   |   q   t   s   t   8   E   E   E   E   E   E   E   E   E   E
        374 361 364 363 364 270 305 305 305 305 305 305 305 305 305 305
0000120   E   E   E   E   E   E   E   E   E   E   E   E   E   E   E   E
        305 305 305 305 305 305 305 305 305 305 305 305 305 305 305 305
*
0000240   m   ;   z dc3   7 sub   c can  em   a   u   5 can   d   2   B
        355   ;   z 023 267 232 343 230 031   a   u   5 230   d 262 302
0000260   X nul   y   J   o   S   -   9   ] stx soh   L can   1   !   j
        330  \0   y 312   o   S 255   9 335 202 001 314 030 261 241   j
0000300 dle   g   o etb   n  ff  em   ]   9   F   ' dc4   }   ,  em   $
        020   g 357 227   n  \f 231   ] 271   F 247 024 375 254 231 244
0000320   Q  si  ff   L  bs   2   # stx   i   5   r   %   |   |   c del
          Q 017 214 314 210   2   # 002 351   5 362 245 374 374 343 177
0000340   m   C esc   H  em enq   ~   X   o   V   p   /   l dc3   N  sp
          m   C 033   H 031 205 376   X   o 326 360 257   l 023   N
0000360   }   ) enq   ( syn   !   3   s   $   E   z dc3   A dc3  ff   P

Answer 1

Try uploading file to http://virustotal.com and look if some antivirus apprehend file as virus.

If you are using Windows, you may use Sysinternals Filemon to check what program did modify it. As alternative, you may turn on auditing in Group Policy, anable auditing for file's folder and check eventlog.

What does unix file utility say about this file?