Do these files look like virus remnants?

Question

We've been having Backup Exec issues related to a corrupt file within SYSVOL on an SBS 2008 server. An anti-virus scan removed a file (the same one BE was failing on) from within the scripts folder as a trojan.

The following files are still in the scripts folder, and I've not seen anything similar in the same location on any of our other SBS 2008 servers so I'm tempted to just delete them as being related to the trojan.

Would you recommend removing them or leaving them? I can post their contents if that would help.

Answer 1

It appears some bits have been flipped in those files' names. Whether this was because of the trojan or not, it's difficult to say. But given the names of the files, it's very unlikely that they have any particular importance, or if they do, they are easily replaced.

Answer 2

That looks like a potentially hardware-- disk controller, cabling, controller cache RAM, or system RAM, or me. I'd get that data backed-up ASAP, verify the integrity of the backups, and start looking for hardware problems. (Don't just verify that the backups match the files on disk, either-- actually verify the integrity of the files. ZIP files can be tested, database files can have their structure checked, etc. If you've got a hardware problem randomly flipping bits on your disk you're going to have problems.)

Being that those files are in the SYSVOL they may have replicated from another DC, too. If you have a single DC then the provenance of the files isn't in question, but if you have multiple DCs you need to check them all out.