Endpoint Protection

 Hi! At work a user had a trojan virus when i ran a full system scan, when i looked at the detailes thrue symantic it showed that it was a low risk virus, but still i turned system restore off, and clicked on remove on the symantic window. after that my pc rebooted and i updated live update and did another system scan and it showes that the virus is gone. i have two questions. 1. do i have to go into the registry and delete anything if it doesnt show the virus anymore? my other question is...when i did the full system scan again it did show tracking cookie, but that it was deleted, what does that mean exactly? as long as it is removed the user is ok right?

As long as it is removed automatically by Symantec its fine.
But even after removing if you face any symptoms then we have to look in to it.

It sounds like you and SEP have managed to get the computer cleaned-up.

 When SEP detect a file as a threat it also delete its Registry entries associated with it.SO if SEP has detected and removed the Trojan you are safe.
Tracking Cookies are something that you need not worry about till SEP detects it should have no connection with the Trojan.

Now after antivirus shown the status as removed the threat ,are you getting any symptom of that virus? If no you need not take any action.

Tracking Cookies are a specific type of cookie that is distributed, shared, and read across two or more unrelated Web sites for the purpose of gathering information or potentially to present customized data to you. Not all cookies are tracking cookies.

<o p=""> </o>Tracking cookies are not harmful like malware, worms, or viruses, but they can be a privacy concern. As an example, if you go to a Web site that hosts online advertising from a third-party vendor, the third-party vendor can place a cookie on your computer. If another Web site also has advertisements from the third-party vendor, then that vendor knows you have visited both Web sites. Nothing malicious has occurred, but the advertising company can determine indirectly all the sites you have been to if they have cookies present on those sites.

ref: http://www.symantec.com/security_response/writeup.jsp?docid=2006-080217-3524-99

 

No need to delete fom the registry, all you have to do is to assure that your antivirus is up to date and it has an schedule scan.

Just as an FYI, when you know you've got real problems when the same threats keep popping up after every scan and the "Process Termination pending reboot' error shows up in the logs even if you reboot.  That's when you really have to start questioning how bad the infection really is.