BlackBerry® Enterprise Service 10

[dq72]

I'm running BES 501 and have about 80 users on the BES system.

Between Feb 20 and 24 we had a number of instances of file deletions on our BES server  by McAffee from the following location:     .....BES Service Account\ Local Settings\Temp\azt57E.tmp  

The message states that it contains W32/Routrobot.worm Trojan.

Looking into that directory there are about 16 azt*.tmp files.

What are these files, and what activity prompts their creation?

It almost seems that during the email transfer something is stored here under the service account and the local scanner is deleting it.

Any ideas?

[rlvron]

Did you ever figure this out?  I also have the same file types being picked up by my endpoint AV scanner (on BES 5.0)

[knottyrope]

Please submit those files to your AV maker and post back if they find anything with those files.

What size is the file?

Have you tried to see if it is really a virus?

 I would also run, Malwarebytes, panda, Spybot, superantivirus, and more to see if you have any real bugs on the server.

Have you ever surfed the internet on the server?