NAV finds virus that's not there anymore?

[dalecooper]

Hi

Regular nightly checks scheduled via the Symantec Control Center notify me of the Bad_Trans Worm on a certain machine, but when I scan the machine individually the next day, it can't be found and the files named in the report (Docs.doc.pif asf.) are gone. But Kernel32.exe is also listed, but seems clean.

How can that be? My guess is, that the virus has once infected that PC, but got insufficiently cleaned so that some files still contain parts of its code.

Any other ideas? What should I do to not get bombed with false virus alerts?

Cheers
Ralf

 

[polymath5]

If the virus has been moved to quarantine on the workstation, the daily scan will find it.

OR....

If it's only showing in SSC; Have you cleared the virus notification flag. The flag stays until you clear it, so if it found a virus on Monday, that same flag would show up every time you looked until you cleared it.

To clear: Right click on the workstation in the SSC. All tasks, Clear Virus notification (or whatever the actual wording is).

Then see if it shows the next morning!

Good luck. =============
Mens et Manus
=============

 

[dalecooper]

Thank you! I cleared the "Virus found" status, after checking that the files listed as infected were really not there anymore. It's going to be interesting, if this machine turns up again in the results of tonight's scan.

 

[polymath5]

Please get back to me and let me know if I steered you in the right direction. I've gone through the same thing, so it's likely that's it. But you never know...

Good Luck. =============
Mens et Manus
=============

 

[dalecooper]

You're very helpful. Judging from your forum list, we have to deal with the same issues in other fields of IT, too

My colleague is dead-sure btw. that the same PCs will turn up in the list after tonight's scan, even if the virus is no longer active on them. I hope, he's wrong, but we'll see.

 

[dalecooper]

Hi Polymath5! Guess what: After tonight's scan these particular machines weren't flagged as having a virus again. I guess that's that

Now I have new questions -see my latest posting. Although I'm sort of a pro in antivirus administration, I've never used Symantec SSC before and I've been doing this particular job where I have to since November 1st.

Thanks for all your help