Вход
Microsoft.com
 
TechNet - Только для профессионалов. Специально для Вас.
 
 
 
TechNet - Только для профессионалов. Специально для Вас. > Форумы > Forefront Client Security Malware Technology and Response > Forefront Client Security hits positive on Mailfrontier-SonicWall email security tmp file
Задайте вопросЗадайте вопрос
Поиск по форумам:
 

ВопросForefront Client Security hits positive on Mailfrontier-SonicWall email security tmp file

  • 22 октября 2008 г. 0:06Dan Specht Медали пользователяМедали пользователяМедали пользователяМедали пользователяМедали пользователя
     
    Войдите в систему, чтобы проголосовать
    0
    Войдите в систему, чтобы проголосовать
      

    Hello,

     

    Forefront Client Security is finding a virus in a temp folder on my Windows Server 2003 - Standard, running Mailfrontier sonic wall email security here:

     

    "Path Found: file:C:\WINDOWS\Temp\kp19A3.tmp"

     

    and identifying a process as running it, that is located here:

     

    "Process Name: C:\Program Files\MailFrontierEG\PluginDefault\policy\verity\bin\kvoop.exe"


    SonicWall ask that  "C:\Program Files\MailFrontierEG\" be excluded from virus scans. Recently Forefront has been finding this virus in the temp folder, and it never has done that before.

    Is this proper practice for SonicWall Email security to temporarily store a virus in the temp folder while it deletes it? Or is this a possible vulnerability? Has anyone else seen anything like this on thier email virus scanning servers?

     

    Thanks,

     

    Dan

     

    == Actual alert - I have received 5 of these in the last 24hrs ==

     

     

    10/21/2008 1:11:17 PM•3004• •Microsoft Forefront Client Security Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. Microsoft Forefront Client Security can't undo changes that you allow.

    For more information please see the following:

    http://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Wantvi.I&threatid=2147607438

    Scan ID: {F51F682C-85C4-40F4-BD46-7C761EF29F8E}

    Agent: On Access

    User: NT AUTHORITY\SYSTEM

    Name: Trojan:Win32/Wantvi.I

    ID: 2147607438

    Severity: Severe

    Category: Trojan

    Path Found: file:C:\WINDOWS\Temp\kp19A3.tmp

    Alert Type:

    Process Name: C:\Program Files\MailFrontierEG\PluginDefault\policy\verity\bin\kvoop.exe

    Detection Type: Concrete

    Status: Suspend ••

     

Все ответы