Cause of file corruption on Lenovo T60

Question

What would be possible causes for corrupt Windows 7 system files? We have 5 Lenovo T60 laptops, and noticed that a system file scan - sfc - showed 2 of the 5 machines had modified files. What would cause this? Keep in mind that:

1. these laptops are never connected to the internet (ran a full A/V scan anyway- nothing found)
2. one that had scf violations just had a clean install of Win 7, from the DVD, 4 weeks ago.

The prime suspect is the hard drive, but I can't prove it. The drives passed 3 diagnostics:

1. Thinkpad's built-in HDD tester (in BIOS)
2. SeaTools
3. Windows scan disk

The drives in these machines are seagate ST910021AS. I am aware of this issue: Seagate Momentus XT corrupting files (Linux and Mac) , but have been unable to reproduce a problem using their steps (those were not on windows anyway).

The issue came up because a vendor's dll was found corrupted 2 weeks after an install - with certainty, the file was correct when it was installed. So the question is, why would the files just change? Is there something that should be looked at other than the hard drive?

More info: found another dll (from a vendor - not a system file), with an invalid checksum. However, the file modified date reported by Windows is expected (2 years ago). Since it was recently installed, it was actually overwritten in the last 2 weeks. Why would the modified date not change?

Answer 1

Have you used the Lenovo diagnostic to check the drive controller? Also, have you run the diagnostics for a period of time(multiple runs)? have seen one test pass and a later one show a problem.

Any hard shutdowns? Have seen this result in a corrupt file.

Have you used bootable media to check for a rootkit?