2 Replies Latest reply on Aug 6, 2012 9:49 AM by pato

    Mailer Worm Not Being Cleaned or Detected

      Hello everyne,

       

      Yesterday we discovered that we weresending out spam through one of our shared email accounts. I traced the source back to a users PC. I ran a full scan and although a few things were picked up, I keep getting these mail blocking events in the Application event viewer which leads me to beleive that the computer is still infected. I ran a bunch of malware/trojan removal tools part from McAfee. The machin still seems to be infected, based on the mass mailing block events. What's the next step if McAfee doesn't pick anything up?

       

       

      Log Name:      Application

      Source:        McLogEvent

      Date:          5/18/2012 2:09:06 PM

      Event ID:      257

      Task Category: None

      Level:         Information

      Keywords:      Classic

      User:          SYSTEM

      Computer:      PCNAME

      Blocked by port blocking rule (Anti-virus Standard Protection:Prevent mass mailing worms from sending mail).

        • 1. Re: Mailer Worm Not Being Cleaned or Detected
          wwarren
          The machin still seems to be infected, based on the mass mailing block events. What's the next step if McAfee doesn't pick anything up?

          But McAfee _is_ picking something up. You posted the Event log entry indicating Access Protection just stomped on an email attempt.

           

          You need to review the Access Protection log file on that client. Get the details of what's being blocked, specifically the Process name.

          That process is the lead you need for finding the alleged malware.

           

          Worth noting is the mail attempt was made using SYSTEM credentials; so ensure you have administrative credentials when trying to investigate further.

          • 2. Re: Mailer Worm Not Being Cleaned or Detected
            pato

            Try to scan the client with Malwarebytes, it usualy picks up brand new viruses way faster than Mcafee. Otherwise use also wwarrens tip for getting to find the mail sending component of the virus.