W32.VIRUT.CONFLICKER

[Migration User]

Hi all,

I installed symantec antivirus 10.1 in my clients managed from centralised server.

Recently w32.virut.conflicker virus infected in some systems

symantec is detecting this virus but instead of cleaning & quaruntine it is deleting the infected files but they are important application files.

please help in this issue

Thanks in advance.

[Mithun Sanghavi]

Hello,

Are you talking about :

1) W32.Virut.A  - http://www.symantec.com/security_response/writeup.jsp?docid=2006-051402-1930-99

2) W32.Virut!html  - http://www.symantec.com/security_response/writeup.jsp?docid=2009-020418-0204-99

3) w32.Conficker - http://www.symantec.com/security_response/writeup.jsp?docid=2008-112203-2408-99

http://www.symantec.com/security_response/writeup.jsp?docid=2008-123015-3826-99

It seems you are mixing 2 threats, or you are confused with names...

In case, its a w32. Conficker, follow the Articles provided by Symantec:

Simple steps to protect yourself from the Conficker Worm
 

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/3aa5a06c7bf48bd988257589006cd1e1?OpenDocument

OR

Best Practice for Downadup.B and Additional information on the same.

https://www-secure.symantec.com/connect/articles/best-practice-downadupb-and-additional-information-same

[Migration User]

Virus is File Infector worm which infects/Corrupts all the windows files or whatever files load into memory.
Would suggest you to change the Action in File System Auto-Protect to Quarantine and second action to Clean. 

[Migration User]

Thankq Ill try it

[Mithun Sanghavi]

Hello,

Did the steps help you??

Since no reply from you, in so many days please REPLY to this.

[Migration User]

ya changed the file system auto protect from delete to quarantine it worked

Thanks a lot