Forum Virus detected
 

Just visiting one of our forums and SOPHOS reported Virus Mal/ExpJS-BC

I've downloaded the entire http folder and performed a scan locally, is this sufficient?

Thanks

- - - Updated - - -

Bit more info on this, the scan picked up a couple of issues, but a different virus.

****************** Sophos Anti-Virus Log - 05/02/2013 11:14:09 **************
...
20130205 103854 File "\tmp\common.php" belongs to virus/spyware 'Troj/PhpShel-M'.
20130205 103858 File "\tmp\in.php" belongs to virus/spyware 'Troj/PhpShel-E'.
...
(2 items)

Also noticed that there is a lot of modified files in the http root from yesterday @ 16:00 when the problem was reported. Surely these should be of the date/time of the last upgrade/etc, not yesterday?