Weird Alert Message

[bigboy2]

Hello,

I'm getting this error message very often from different comupters over the network:

"the file xxxxxx is infected with '_' Known Virus. Detected with Scan Engine 4.1.60 DAT Version 4.0.4237. ( FROM PC101 IP xxx.xxx.xxx.xxx user SYSTEM running VirusScan '_' OAS)


anyone has any idea what does that mean ? and how can i avoid having those alerts ?

 

[AVDude]

Hi

Looks like you have activated Alert Manager on your workstations to send a Network Message.

Check your VisrusScan config and turn it off on your NetShield / Alert Manager.

Cheers
AVDude

 

[bigboy2]

Hello again,

Yeah, I did activate Alert Manager, but what i'm asking about is the - '_' Known Virus - What does that mean ?

It's not really a virus but I get a lot of those messages.

 

[AVDude]

Ok

You need to check the log on the machine that sends the alert. It could be a virus detected generecally or heuristically. IE, no name can be fitted on the virus code.

Cheers
AVDude

 

[bigboy2]

Hello again,

I've checked, and on all computers which sent that alert the heuristics and macro scanning is not enabled.

what causes this message ? How do i disable it ?

 

[bigboy2]

Hello,

You were probably right AVDude. Now my problem is setting the " enable heuristics scanning " off on all the computers on the network. I plan to do that via a script on the netlogon which will change the registry, but when i changed it, i saw it didn't take effect.

(I changed the 2 values concerning the heuristics scanning in the on acces key in the registry)

Is there something else i should do ?

 

[AVDude]

Hi

You might want to think about that they could alert on a real virus.
Run on demand scan and take a look in the logs to make sure that your clients are virus free.
That should be of more concern than any network messages.

Bare in mind that heuristics gives you that extra protective layer.

Are you running ePO? If not, that config change would be a piece of cake.

Cheers
AVDude

 

[bigboy2]

Hello Again,

I'm not working with ePO. How do i disable only the heuristics scanning on each computer without entering the advanced window ? ( by changing the registy maybe )

 

[AVDude]

Hi

Probably some tweaking in the registry. I'm running ePO myself so I have never gone that way.

Cheers
AVDude

 

[bigboy2]

It's ScanArchiveTimeout

 

[AVChap]

Suggest you install VS 4.51 SP1 or NS 4.5 SP1. This ScanArchiveTimeout should be addressed there. If not, if you can access the NAI Knowledge Base, I believe they have a registry fix for this.

HTH,
AVChap
... take my advice, I don't use it anyway!