Ask a question

Search Forums:

• Search Forefront Client Security Malware Technology and Response Forum
• Search All Forefront Client Security Forums
• Search All Microsoft TechNet Forums

 

Forefront Client Security hits positive on Mailfrontier-SonicWall email security tmp file

• Wednesday, October 22, 2008 12:06 AMDan Specht

   
  

  0

  Sign In to Vote
    

  Hello,

   

  Forefront Client Security is finding a virus in a temp folder on my Windows Server 2003 - Standard, running Mailfrontier sonic wall email security here:

   

  "Path Found: file:C:\WINDOWS\Temp\kp19A3.tmp"

   

  and identifying a process as running it, that is located here:

   

  "Process Name: C:\Program Files\MailFrontierEG\PluginDefault\policy\verity\bin\kvoop.exe"
  

  
  SonicWall ask that  "C:\Program Files\MailFrontierEG\" be excluded from virus scans. Recently Forefront has been finding this virus in the temp folder, and it never has done that before.
  

  Is this proper practice for SonicWall Email security to temporarily store a virus in the temp folder while it deletes it? Or is this a possible vulnerability? Has anyone else seen anything like this on thier email virus scanning servers?

   

  Thanks,

   

  Dan

   

  == Actual alert - I have received 5 of these in the last 24hrs ==

   

   

  10/21/2008 1:11:17 PM•3004• •Microsoft Forefront Client Security Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. Microsoft Forefront Client Security can't undo changes that you allow.

  For more information please see the following:

  http://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Wantvi.I&threatid=2147607438

  Scan ID: {F51F682C-85C4-40F4-BD46-7C761EF29F8E}

  Agent: On Access

  User: NT AUTHORITY\SYSTEM

  Name: Trojan:Win32/Wantvi.I

  ID: 2147607438

  Severity: Severe

  Category: Trojan

  Path Found: file:C:\WINDOWS\Temp\kp19A3.tmp

  Alert Type:

  Process Name: C:\Program Files\MailFrontierEG\PluginDefault\policy\verity\bin\kvoop.exe

  Detection Type: Concrete

  Status: Suspend ••

  • Reply
  • Quote