Endpoint Protection

HI There,
We have a problem with symantec anti virus which is not able to delete the trojan vundo. we are unmanaged mode at one network and other network we are into managed mode. in both the cases endpoint not able to delete the files. endpoint not even run in the safe mode.

first update ur AV
then run scan in safe mode

if u need any help post it here
let me knw the results k?

hi, how do you know its trojan, did you run scan from another Av, submit those files to securityresponse, may be no definition available for this new variant :-(.
Pete!

we updated the AV but no use, the virus come and sit in C: as .exe. when we delete it manually insafe mode after some time it will again come.
the SEP deosn't run in safe mode to scan. if we scan in normal mode it doesn't detect the virus..

Try downloading the Trojan Vundo Removal Tool,

Download it here

http://www.symantec.com/security_response/writeup.jsp?docid=2004-112210-3747-99

Trojan.Vundo
Trojan.Vundo.B

Try to run both, and after, you can check the logs, you will find the logs on the path where you ran the removal tool.

 Can you name the exe's, also are they running on system32? Which version of symantec are you running?

Trojan.Vundo is a fairly old virus. So unless you're getting an updated version of the malware, you either have corrupt definitions, a faulty installation or users who have disabled the AV to speed up their PCs and you only detect it when it tries to infect the protected part of your network. Go to one of the infected clients check for any traces of the trojan, whose technical details may be found here:
http://www.symantec.com/norton/security_response/writeup.jsp?docid=2005-042810-2611-99&tabid=2
Assuming you have the later variant.

Any updates on this issue? Please also check SYSTEM account's permissions on the infected folders.

Get the updated Anti-virus of symantec. I also have the same problem but by updating the AV it has been solved