提出问题

搜索论坛：

• 搜索所有 Microsoft TechNet 论坛

 

Forefront Client Security hits positive on Mailfrontier-SonicWall email security tmp file

• 2008年10月22日 0:06Dan Specht

   
  

  0

  登录进行投票
    

  Hello,

   

  Forefront Client Security is finding a virus in a temp folder on my Windows Server 2003 - Standard, running Mailfrontier sonic wall email security here:

   

  "Path Found: file:C:\WINDOWS\Temp\kp19A3.tmp"

   

  and identifying a process as running it, that is located here:

   

  "Process Name: C:\Program Files\MailFrontierEG\PluginDefault\policy\verity\bin\kvoop.exe"
  

  
  SonicWall ask that  "C:\Program Files\MailFrontierEG\" be excluded from virus scans. Recently Forefront has been finding this virus in the temp folder, and it never has done that before.
  

  Is this proper practice for SonicWall Email security to temporarily store a virus in the temp folder while it deletes it? Or is this a possible vulnerability? Has anyone else seen anything like this on thier email virus scanning servers?

   

  Thanks,

   

  Dan

   

  == Actual alert - I have received 5 of these in the last 24hrs ==

   

   

  10/21/2008 1:11:17 PM•3004• •Microsoft Forefront Client Security Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. Microsoft Forefront Client Security can't undo changes that you allow.

  For more information please see the following:

  http://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Wantvi.I&threatid=2147607438

  Scan ID: {F51F682C-85C4-40F4-BD46-7C761EF29F8E}

  Agent: On Access

  User: NT AUTHORITY\SYSTEM

  Name: Trojan:Win32/Wantvi.I

  ID: 2147607438

  Severity: Severe

  Category: Trojan

  Path Found: file:C:\WINDOWS\Temp\kp19A3.tmp

  Alert Type:

  Process Name: C:\Program Files\MailFrontierEG\PluginDefault\policy\verity\bin\kvoop.exe

  Detection Type: Concrete

  Status: Suspend ••

  • 回复
  • 引用