Endpoint Protection

hi

i found virus in my pc called win32sta.dll in windows dir and user dir and created Registry Value :
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Bindows]
AppInit_DLLs = "%System%\win32sta.dll"
DeviceNotSelectedTimeout = "15"
GDIProcessHandleQuota = 0x00002710
Spooler = "yes"
swapdisk = ""
TransmissionRetryTimeout = "90"
USERProcessHandleQuota = 0x00002710
LoadAppInit_DLLs = 0x00000001

and he prevent me to enter to any anti virus we by changing host file at win\system32\drive\etc\host

also pevent windows update

But sep didn't founded

so i run at safe mode and deleted from my pc

and deleted the reg

If SEP is not detecting the threat then make sure you submit the Suspicious/Infected files to Symantec Security response so that they can create a definitions for it.

It was 1 machine so you deleted it and now you are ok , however if it had been 100 machines you can't do that and if you are infected with same threat again you cannot repeat the steps again and again.

So its just a 1 time pain do submit the files to Symantec

http://www.symantec.com/business/security_response/submitsamples.jsp

Thanks Vikram

Yes it only on 1 machine

I didn't know about this procedure

But if I infected with same threat again or any unknown threat I will submit the files to Symantec

Hello,

Follow these Steps: