Forefront Client Security hits positive on Mailfrontier-SonicWall email security tmp file

Wed, 22 Oct 2008 00:06:13 Z

Hello,

Forefront Client Security is finding a virus in a temp folder on my Windows Server 2003 - Standard, running Mailfrontier sonic wall email security here:

"Path Found: file:C:\WINDOWS\Temp\kp19A3.tmp"

and identifying a process as running it, that is located here:

"Process Name: C:\Program Files\MailFrontierEG\PluginDefault\policy\verity\bin\kvoop.exe"

SonicWall ask that "C:\Program Files\MailFrontierEG\" be excluded from virus scans. Recently Forefront has been finding this virus in the temp folder, and it never has done that before.

Is this proper practice for SonicWall Email security to temporarily store a virus in the temp folder while it deletes it? Or is this a possible vulnerability? Has anyone else seen anything like this on thier email virus scanning servers?

Thanks,

Dan

== Actual alert - I have received 5 of these in the last 24hrs ==

10/21/2008 1:11:17 PM•3004• •Microsoft Forefront Client Security Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. Microsoft Forefront Client Security can't undo changes that you allow.

For more information please see the following:

http://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Wantvi.I&threatid=2147607438

Scan ID: {F51F682C-85C4-40F4-BD46-7C761EF29F8E}

Agent: On Access

User: NT AUTHORITY\SYSTEM

Name: Trojan:Win32/Wantvi.I

ID: 2147607438

Severity: Severe

Category: Trojan

Path Found: file:C:\WINDOWS\Temp\kp19A3.tmp

Alert Type:

Process Name: C:\Program Files\MailFrontierEG\PluginDefault\policy\verity\bin\kvoop.exe

Detection Type: Concrete

Status: Suspend ••

Forefront Client Security hits positive on Mailfrontier-SonicWall email security tmp file

Thu, 05 Mar 2009 19:57:17 Z

It's actually fairly common for AV to have some type of temp folder that it may use to unarchive contents of .zip's .cabs .rars etc while scanning

CSS Security Support Engineer (FCS/MBSA/WUA/Incident Response) Check out my blog http://blogs.technet.com/kfalde