02-26-2010 03:06 PM
I'm running BES 501 and have about 80 users on the BES system.
Between Feb 20 and 24 we had a number of instances of file deletions on our BES server by McAffee from the following location: .....BES Service Account\ Local Settings\Temp\azt57E.tmp
The message states that it contains W32/Routrobot.worm Trojan.
Looking into that directory there are about 16 azt*.tmp files.
What are these files, and what activity prompts their creation?
It almost seems that during the email transfer something is stored here under the service account and the local scanner is deleting it.
I'm rockin the BlackBerry DTEK60, Passport, Z30, Z10, Q10, BlackBerry Mini Stereo Speaker, 64 gig PlayBook,BT Headset HS-700
03-31-2011 10:40 AM - edited 03-31-2011 10:43 AM
Please submit those files to your AV maker and post back if they find anything with those files.
What size is the file?
Have you tried to see if it is really a virus?
I would also run, Malwarebytes, panda, Spybot, superantivirus, and more to see if you have any real bugs on the server.
Have you ever surfed the internet on the server?
BESAdmin's, please make a signature with your BES environment info.
BES 12 and BES 5.0.4 with Exchange 2010 and SQL 2012 Hyper V