W32.Wecorl.a (or Variant) Infection across enterprise
in [Anti-Virus]
|
Prev: Recovering from the Flawed McAfee Update
Next: McAfee IDs standard Windows file as a virus. Affects thousands of corporate clients
From: wperry1 on 21 Apr 2010 11:26 My company has just been hit with what seems to be a massive infection of a new variant of the W32.wecorl.a virus. It has spread and infected a large number of systems in our HQ office and for our remote users. Users boot up and log in then they get a notice from McAfee that an infection was detected and the system shuts down and reboots. Systems are primarily WinXP with up-to-date patches and running McAfee VirusScan Enterprise with updated Defs (at least to yesterday) Is anyone else dealing with this? Any ideas on effective widespread removal techniques?
From: bluetrevian on 21 Apr 2010 13:39 This is a false positive. Check the McAfee Community site here: http://community.mcafee.com/message/125576 Check the McAfee OFFICIAL response here: http://community.mcafee.com/message/125576
From: bluetrevian on 21 Apr 2010 13:46 This is a false positive. Check the McAfee Community site here: http://community.mcafee.com/message/125576 Check the McAfee OFFICIAL response here: http://home.mcafee.com/VirusInfo/VirusProfile.aspx?key=265240
From: David H. Lipman on 21 Apr 2010 16:32 From: "wperry1" <wperry1(a)gmail.com> | My company has just been hit with what seems to be a massive infection | of a new variant of the W32.wecorl.a virus. It has spread and infected | a large number of systems in our HQ office and for our remote users. | Users boot up and log in then they get a notice from McAfee that an | infection was detected and the system shuts down and reboots. | Systems are primarily WinXP with up-to-date patches and running McAfee | VirusScan Enterprise with updated Defs (at least to yesterday) | Is anyone else dealing with this? Any ideas on effective widespread | removal techniques? McAfee f**ked this one up ! The 5959 dat files have been released early due to a DAT Issue Emergency with the 5958 DAT Files. The reason for this DAT Issue Emergency is a 'W32/Wecorl.a' False Positive in 5958 DAT. The various 5959 dat file packages can be found at http://www.mcafee.com/apps/downloads/security_updates/dat.asp http://www.us-cert.gov/current/index.html#mcafee_dat_5958_issues -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
From: FromTheRafters on 21 Apr 2010 17:52
"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message news:hqnndj02tt9(a)news3.newsguy.com... > From: "wperry1" <wperry1(a)gmail.com> > > | My company has just been hit with what seems to be a massive > infection > | of a new variant of the W32.wecorl.a virus. It has spread and > infected > | a large number of systems in our HQ office and for our remote users. > > | Users boot up and log in then they get a notice from McAfee that an > | infection was detected and the system shuts down and reboots. > > | Systems are primarily WinXP with up-to-date patches and running > McAfee > | VirusScan Enterprise with updated Defs (at least to yesterday) > > | Is anyone else dealing with this? Any ideas on effective widespread > | removal techniques? > > McAfee f**ked this one up ! > > The 5959 dat files have been released early due to a DAT Issue > Emergency with the 5958 DAT > Files. > > The reason for this DAT Issue Emergency is a 'W32/Wecorl.a' False > Positive in 5958 DAT. > > The various 5959 dat file packages can be found at > > http://www.mcafee.com/apps/downloads/security_updates/dat.asp > > http://www.us-cert.gov/current/index.html#mcafee_dat_5958_issues Yet another DoS made possible by security software. :o) |