Video Screencast Help
Search Video Help Close Back
to help
New in the Rewards Catalog: Vouchers for "Symantec Technical Specialist" and "Symantec Certified Specialist" exams.

fixing Left Alone virus

Updated: 21 May 2010 | 5 comments
Marc C's picture
0 0 Votes
Login to vote
How do you handle viruses that have been "left alone" by a scheduled scan. to be more specific the schedule scan detects the virus, can't delete or clean so it leaves alone. The file in question is in a compressed file.
the scan is set to automatically clean then delete.
 
thanks for any help.

Comments

cmartinjr's picture
15
May
2008
0 Votes 0
Login to vote

I'd try these in this order
 
- Delete the entire compressed file through dos
- Scan the compressed file in safe mode
 
Marc C's picture
15
May
2008
0 Votes 0
Login to vote

Sorry, I didn't give enough detail.
Everyonce in a while during a scheduled scan scs will not be able to clean a virus in a compressed file. It will try to clean then delete (per setup) then just leave alone.
I know I can do it manually however since I manage 7000+ machines doing it manually is not an option.
My question then is how can I set it up to automatically delete these files, it doesn't make sense that it is unable too.
 
thanks again
cmartinjr's picture
15
May
2008
0 Votes 0
Login to vote

Do you have the option selected to stop processes when it finds an active virus?
Marc C's picture
15
May
2008
0 Votes 0
Login to vote

yes
cmartinjr's picture
16
May
2008
0 Votes 0
Login to vote

Usually if symantec reports it as "left alone" it's because a process has it locked, which is why I suggested running a scan in safe mode.  If you have an active virus you really don't have a lot of options if Symantec av can't remove the file other than running a scan in safe mode, whether it's one client or 1 million.
 
If it were me I'd get Symantec support involved, there may be a parent process that's creating this file.  Symantec av may not be detecting the parent process.  I've found quite a few viruses over the years that symantec wasn't detecting, submitted it to them, and they've created definitions for it. 
 
If you do have a file that you think may be the parent process you can submit it to symantec.  In the meantime while waiting on Symantec you can submit it to http://www.virustotal.com/.  They scan the file with multiple av vendor's product and will let you know pretty quick if it's viral.
 
While doing this I'd have someone else scan one of the workstations in safe mode to see if it removes the file.