False Positives, CRITICAL: NETWORK VIRUS DETECTED
I have been getting many emails from the SEP server with the subject "CRITICAL: NETWORK VIRUS DETECTED". It always shows that a "Trojan Horse - Viral" is the Risk Type. The problem is that these warnings are all false positives - SEP is detecting its own virus definition update files as a risk! Look at the following folders/files:
c:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer\
c:\Documents and Settings\johnsmith\Local Settings\Temp\DWH6FDC.tmp
Those are from 2 of the supposed "Trojan Horse" warnings. If I add these folder locations into a Centralized Exception Policy so that they aren't scanned, then the warnings stop. Why should I have to exclude SEP's own folders from being scanned, and why is this happening in the first place?
Comments
hi
follow this document
Large amounts of temp files are being created in the xfer_tmp or 7.5/xfer folder and are being detected as threats.
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009042217073548
Please don't forget to mark your thread solved with whatever answer helped you : ) Rafeeq
Same issue here...
... the article above does NOT explain or solve the issue, it is only a temporary fix. Why would SEP detect malware in it's own xfer folder if indeed that's what it's doing? I had a machine with 250,000 tmp files in the xfer folder!
Will Be Fixed in a Future Release of SEP 11
Hi Nfcadmin and Mobiustrip,
In certain rare conditions this behavior can occur. Symantec engineers are investigating and code changes are forthcoming that will prevent this from happening.
In the meantime, make sure that your SEPM and SEP clients are runnign the current release (RU5) and please do try the steps recommended by Rafeeq above.
Thanks and best regards,
Mick
With thanks and best regards,
Mick
Conditions are becoming less rare...
I now have 5 workstations exhibiting this same behavior.
I will update to the new release and thanks for your quick, but admittedly vague, response Mick.
I have copied Nfcadmin's example and created a centralized exception to the xfer folder. Now I shall go about the ugly task of deleting the quarter million .tmp files in the all users xfer folder.
Would you like to reply?
Login or Register to post your comment.