Endpoint Protection

 View Only
  • 1.  rorpian.E!inf

    Posted Jul 13, 2011 09:29 AM

    Has any one detected/heard about rorpian.E!inf virus? One of our clients use Microsoft System Sweeper and find this risk: rorpian.E!inf. Endpoint did not pick it up.

    When I did a google search for the above mention named, the results are less than 20 whose majority comes from Microsoft website.

    Is this a valid risk or a false positive?

     

    Thanks,

    -Chuan



  • 2.  RE: rorpian.E!inf

    Posted Jul 13, 2011 09:49 AM

    Please submit the file to the security response team.

     

    Scanning a file with a competitor's antivirus program detects a virus, but scanning with Symantec AntiVirus or Symantec Endpoint Protection does not

     

    http://www.symantec.com/business/support/index?page=content&id=TECH98929



  • 3.  RE: rorpian.E!inf

    Posted Jul 13, 2011 10:00 AM

    Unfortunately, there isn't an industry standard on what truly is an "infected" file.  Symantec classifies files as infected if they contain viral code.  Others don't.

    As an example, say a worm infects a machine, changes the desktop background to a picture of a kitten, then spreads across the network.  Symantec would look at the .jpg that's dropped as part of the payload, see that there's no viral code in the file and leave it alone.  Other vendors may flag it as infected and remove it, even though it didn't contain any viral code...it's just a picture of a kitten.

    The best bet would be to submit the file(s) in question to us so we can get a look at them.  It's possible that this is a new variant that we don't have definitions for yet...we simply won't know until we get a sample and have reviewed it.



  • 4.  RE: rorpian.E!inf

    Trusted Advisor
    Posted Jul 13, 2011 11:05 AM

    Hello,

    A "Thumps up" to Chris and Rafeeq's Advice .

    Here are few more Articles which you should follow when you suspect a Suspicious files.

     

    1) Symantec Support Tool: How to collect suspicious files and submit the samples to the Symantec Security Response Team.
     
     
    2) Scanning a file with a competitor's antivirus program detects a virus, but scanning with Symantec AntiVirus or Symantec Endpoint Protection does not
     
     
    3) What to do when you suspect that a Symantec AntiVirus product is not detecting viruses
     
     
    Hope this Helps!!!


  • 5.  RE: rorpian.E!inf
    Best Answer

    Posted Jul 13, 2011 11:33 AM

    It may be a new variant of the rorpian worm. Symantec detects that as W32.SillyFDC.BDP

    http://www.symantec.com/security_response/writeup.jsp?docid=2011-031106-4835-99

    As stated above, please submit the file for analysis.

     

    Best,

    Thomas



  • 6.  RE: rorpian.E!inf

    Posted Jul 14, 2011 09:46 AM

    Thumbs for everyone. Thank you for the reply.

     

    regards,

    -Chuan