NAV lists virus that's not there?

[dalecooper]

Hi

Regular nightly checks scheduled via the Symantec Control Center notify me of the Bad_Trans Worm on a certain machine, but when I scan the machine individually the next day, it can't be found and the files named in the report (Docs.doc.pif asf.) are gone. But Kernel32.exe is also listed, but seems clean.

How can that be? My guess is, that the virus has once infected that PC, got insufficiently cleaned so some files still contain parts of its code.

Any other ideas?

Cheers
Ralf

 

[Kento]

Kernel32.exe is not a windows file. It's the virus disguised as a windows file so if it's there delete it. Can this machine connect to the net? If so go here and run this online scan. But if you delete kernel32.exe the scan may not find anything.

http://housecall.trendmicro.com/

More info...

http://securityresponse.symantec.com/avcenter/venc/data/w32.badtrans.gen@mm.html

http://securityresponse.symantec.com/avcenter/venc/data/w32.badtrans.b@mm.html

I don't know what version of badtrans you're supposed to have but run this free removal tool on the infected pc and see if it finds anything...

http://securityresponse.symantec.com/avcenter/venc/data/w32.badtrans.b@mm.removal.tool.html

 

[Kento]

Those links are messed up there so just copy and paste them starting with 'http...' into your address bar and hit enter.

 

[dalecooper]

Thanks for replying! I checked the files on the machine again and the ones that were listed as infected are all gone. As someone pointed out in the other forum -to which I accidentally posted before finding this one- it appears as if the "Virus found" status is an old one and the flag on the workstation wasn't cleared in SSC.

I've done that now and will wait, if it turns up again in tonight's scan.

I find it a strange concept in SSC, that the status of a workstation is maintained until manually cleared, even if the latest scheduled scan didn't find a virus. Instead the files from the initial scan, that found a virus turn up again and again. Good to get lazy admins, of course