Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

XP Machine 32 Bit Still Infected 1 item (Virus)

Created: 24 Jul 2013 | 12 comments

There is a machine that I have run a full scan on, upgraded and cleared the logs from, the "J" drive is not even there any longer, but it still populates in the Still infected items as a virus..

j:\qcum.pif

That is what it finds, the drive has been gone for a week and the file is nowhere to be found. I want this gone from the still infected items, the logs are set to be cleared after three days, why does it continue to show up?

Operating Systems:

Comments 12 CommentsJump to latest comment

.Brian's picture

is it showing in the SEPM risk log? If so, check the remote source.
 

I see this happen when a remote host is infected.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

The Conquistador's picture

It is in the still infected items.

I have checked the PC up and down, the drive isn't even there anymore.

.Brian's picture

When you click on Details, does it show a remote IP?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

The Conquistador's picture

I checked the risk logs in the monitors and saw a bunch of old stuff, strangely enough that wasn't there.

The Conquistador's picture

I went to the monitors, and added that PC's IP, to the risks and it didn't even show.

.Brian's picture

Supoprt call cool

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

The Conquistador's picture

Can't take that kind of abuse late in the week. That's more of a Monday thing.

.Brian's picture

Gotta love it...

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

.Brian's picture

Cool. Lemme know how it goes. I have a feeling it's related to the DB though...

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.