Formular una pregunta

Búsqueda de foros:

• Buscar en el foro de Forefront Client Security Malware Technology and Response
• Buscar en todos los foros de Microsoft TechNet

 

Forefront Client Security hits positive on Mailfrontier-SonicWall email security tmp file

• miércoles, 22 de octubre de 2008 0:06Dan Specht

   
  

  0

  Inicie sesión para votar
    

  Hello,

   

  Forefront Client Security is finding a virus in a temp folder on my Windows Server 2003 - Standard, running Mailfrontier sonic wall email security here:

   

  "Path Found: file:C:\WINDOWS\Temp\kp19A3.tmp"

   

  and identifying a process as running it, that is located here:

   

  "Process Name: C:\Program Files\MailFrontierEG\PluginDefault\policy\verity\bin\kvoop.exe"
  

  
  SonicWall ask that  "C:\Program Files\MailFrontierEG\" be excluded from virus scans. Recently Forefront has been finding this virus in the temp folder, and it never has done that before.
  

  Is this proper practice for SonicWall Email security to temporarily store a virus in the temp folder while it deletes it? Or is this a possible vulnerability? Has anyone else seen anything like this on thier email virus scanning servers?

   

  Thanks,

   

  Dan

   

  == Actual alert - I have received 5 of these in the last 24hrs ==

   

   

  10/21/2008 1:11:17 PM•3004• •Microsoft Forefront Client Security Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. Microsoft Forefront Client Security can't undo changes that you allow.

  For more information please see the following:

  http://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Wantvi.I&threatid=2147607438

  Scan ID: {F51F682C-85C4-40F4-BD46-7C761EF29F8E}

  Agent: On Access

  User: NT AUTHORITY\SYSTEM

  Name: Trojan:Win32/Wantvi.I

  ID: 2147607438

  Severity: Severe

  Category: Trojan

  Path Found: file:C:\WINDOWS\Temp\kp19A3.tmp

  Alert Type:

  Process Name: C:\Program Files\MailFrontierEG\PluginDefault\policy\verity\bin\kvoop.exe

  Detection Type: Concrete

  Status: Suspend ••

  • Responder
  • Citar