Endpoint Protection

 View Only
  • 1.  U3ROM

    Posted Dec 20, 2010 11:51 AM

    WIN XP SP3 IS OS IN MY DESLTOP

    Any usb storage attached to it and subsequntly attached to other servers and desktops show "autorun.inf" and "U3rom"

    u3rom is displayed with ICON of recycle Bin

    Symantec (11) endpoint protection is loaded in system



  • 2.  RE: U3ROM

    Posted Dec 20, 2010 12:04 PM

    If updating the definitions fails to detect anything.

     

    Try booting into safe mode and running a Disk Cleanup (right-click the C drive, Properties, Disk Cleanup) - that will delete all the files that are in these temporary locations, as well as IE's temporary files, etc. Perform a full system scan in safe mode.

    If that fails to detect and remove the threats,

    there are useful some tools that are provided by Symantec for help with finding those hard to detect threats.

    1.       The Power Eraser Tool eliminates deeply embedded and difficult to remove threats that traditional virus scanning doesn't always detect.

    2. The SERT (Symantec Endpoint Recovery Tool)is useful in situations where computers are too heavily infected for the Symantec Endpoint Protection client installed upon them to clean effectively.

     

    3. The Load point Analysis Tool generates a detailed report of the programs loaded on your system. It is helpful in listing common loadpoints where threats can live.

     

     

    Rapid Release Virus Definitions –

    http://www.symantec.com/business/security_response/definitions/download/detail.jsp?gid=rr

     

    Power Eraser tool –

    http://security.symantec.com/nbrt/npe.asp?lcid=1033&origin=default

     

    How To Use the Symantec Endpoint Recovery Tool with the Latest Virus Definitions –http://www.symantec.com/business/support/index?page=content&id=TECH131732&locale=en_US

     

    Support Tool with Power Eraser Tool included –

    http://www.symantec.com/business/support/index?page=content&id=TECH105414&locale=en_US

    How to use the Load Point Analysis within the Symantec Support Tool to help locate suspicious files http://www.symantec.com/business/support/index?page=content&id=TECH141402



  • 3.  RE: U3ROM
    Best Answer

    Posted Dec 20, 2010 12:05 PM

    Download the latest rapid release defs and run a full scan on a machine

    http://www.symantec.com/business/security_response/definitions.jsp

    You shoul also submit the malicious executable to security response

    https://submit.symantec.com/websubmit/gold.cgi

    You should also disable autorun company wide

    Brief writeup on the virus:

    http://about-threats.trendmicro.com/Malware.aspx?language=us&name=WORM_PALEVO.KK