Endpoint Protection

Hello,

I have File server (Windows 2K3 SP2 STD) with SEP 11.0.4000 installed.
All the shared folders are stored in the Drive F. In some shared folder, for every folder created, a new folder.exe is created.
the dirve C (System) seemed not infected.
I run a full scan with SEP but nothing was detected.
How can I remove this malware?

Regards,

Hello neww;
Please update your sep client and Windows Update. I know this issuise and I beat it via safe mode scan.
please dont forget the updates.

Best Regards.
Fatih

upload infected file Symantec response team. they will provide you rapid release on this. newfolder.exe its detect on Symantec i think your file is variants, that's why is not abal to detect in Symantec. submit suspicious file to Symantec.

Hi Fatih,

It is never recommended to upgrade when an infection is there on a machine.

When the infection is taken care of, then we can think of an upgrade.

Because upgrade will disble the realtime protection for a few minutes which may cause more damage.

And if infection has affected the installer as well, then the upgrade may fail, leaving the system unprotected,

Regards,
Aniket

PLease take a look at the article below:

http://www.symantec.com/security_response/writeup.jsp?docid=2003-053009-5408-99


https://www-secure.symantec.com/connect/forums/how-delete-viruses-usb-drive-newfolderexe-virus

Best Regards,
Aniket

Here is another variant of the newfolder.exe threat.

http://www.symantec.com/security_response/writeup.jsp?docid=2008-122309-4341-99

Submit the file to ThreatExpert. com or Security Response ASAP.

http://www.threatexpert.com/submit.aspx

http://www.symantec.com/business/security_response/submitsamples.jsp

YEs you Right But as you well know this (new folder.exe) create themself when you click one folder. This virus create new exe file picture like folder and copy same name folder. This virus cannot copy themself on lan or another machine. (I saw it when i in army and same actions)
Therefore i said update Sep client. If i said something wrong i am sorry :)

Best Regards.
Fatih

Hi Fatih,

Thanks for the input.

The new folder.exe may spread from a network share as well.

But I agree with you on the point that the SEP client must have the latest virus definitions to take care of the risks.

I would also suggest to use the recovery CD and give it a try to scan from it.

Aniket

Hello Aniket,
Yes you rigth. Thank you for information. :) I know Sep can easly delete this virus if have latest definition ;)

Best Regards.
Fatih

Hi all,

I submit the file to the security response and it is identified as the Trojan.Gen. I run a full scan and it is quaratined now

Regards,

Good news. You can perform another scan in the safe mode as well to see id the file gets deleted/cleaned.

Aniket