A company server was infected with malware in the fall of 2011, but the infection wasn’t detected until two months ago.