Patched-SYSFile.d infections.

[SamSwift]

Hi,

Not sure why the move thread didn't work - I've just done it again and it's moved correctly.

It's not a faulty driver, certain drivers are drip-fed through various products rather than made available across the board immediately. This is something we have been doing for years, and is why support recommend running a command line scan as part of the isolating samples troubleshooting steps.

The samples were escalated to research so I will speak to the research team to find out when the driver will be included at the VSE level.

Kind regards,

Sam

[SamSwift]

Further to this I'd like to clarify the best way for corporate customers to submit samples to us.

Portal is the preferred method. If it's not available then email is the next best option. Webimmune is the least preferred method as it is publically available to anyone regardless of whether or not they are a customer. The queue for webimmune responses can often be much longer than portal or email.

And for any of these types of submissions if you wish to get your samples escalated quicker please contact technical support by telephone, as this way you are covered by the SLAs that support provide. Support can also give further advice about what you can do whilst awaiting a response from McAfee Labs.

Will be back ASAP with further information on the samples.

Sam

[Former Member]

Thank you for your reaction!

1. "Portal is the preferred method"

as I wrote (28.05.2010 13:56)

Virsus Sample Upload (Submit a  Sample -Technical Support Portal) is not working (Error)

[cut]

Analysis ID: 6014336 

do you need some other ID?

2. " If it's not available then email"

6019894	Mail	pci.sys	inconclusive	null	null	05/31/10	No
6014336	WEB	pci.sys	inconclusive	null	null	05/27/10	No

Maybe I choose "wrong E-Mail" adress - not the one my company registered.

3. Today I opended a Service Request - got an Error, but it worked:

Service Request# 3-905854453 has been resolved

but,

> To view or update this service request go to  http://mysupport.mcafee.com/eservice_enu
No records found
Query: 3-905854453 No records found
Sorry I can't see any solution and there is no solution in the answer.

Nachricht geändert durch andydu on 07.06.10 18:14:09 GMT+01:00

Nachricht geändert durch andydu on 07.06.10 18:16:11 GMT+01:00

[SamSwift]

Hi,

The SR was closed as eService abandoned - which looks like it either wasn't submitted again after possible KB articles were offered, or there was something else going on.

Submitting samples via the portal is via the 'submit a sample' link you get when you are logged in to the mysupport site.

I submitted the same file yesterday via the portal and got a response to say detection is included in the current dats, and I have requested reasrch also pull your samples from their queue to respond accordingly.

Are you still seeing the sample detected only the CLS, or are the current DATs now picking it up for you with VSE?

Sam

[Former Member]

Hello,

" it either wasn't submitted again after possible KB articles were  offered, or there was something else going on."  - OK... so how shoud I know the solution?

It looks like Win7 & XP VSE 8.7 still can't find it (Screenshot).

@Mal09: how about you? Still no detection?

CLS can find this Virus even using old DATs.

[Former Member]

andydu wrote:
It looks like Win7 & XP VSE 8.7 still can't find it (Screenshot).
@Mal09: how about you? Still no detection?
CLS can find this Virus even using old DATs.

8.7i with either the 6006 dat, or the 06/08/2010 07:34 PT beta dats still doesn't detect the file. .

[SamSwift]

Hi Andy - when you submit a sample via the service portal you need to follow the process here please

Both - I've escalated this issue to research management. Will report back as soon as possible.

Sam

[Former Member]

SamPrice schrieb:
Hi Andy - when you submit a sample via the service portal you need to follow the process here please
Both - I've escalated this issue to research management. Will report back as soon as possible.
Sam

Tnx, last two times I tryied, I followed this KB. This time it worked                                                                                                       3-918509861 (sorry for submiting once more) - I was sure it will not work.

This time I can even see my request.

[Former Member]

Mal09 Tnx!

Sam I wonder how your VSE can detect it:

1. Fresh installation Windows 7 32 Bit

2. Package download from NAI and Installation:

McAfee VirusScan Enterprise 8.7 (inkl. Patch 3) Repost

3. Update

4. Reboot

5. Scan File : no detection

in 20-30 min. I will have Windows XP & VSE 8.5 Installed and I will let you know ...

Clean XP Installation, VSE 8.5 DAT 6006 - the same no detection

Nachricht geändert durch andydu on 08.06.10 18:00:53 GMT+01:00

Nachricht geändert durch andydu (XP Screenshot) on 08.06.10 20:47:48 GMT+01:00

[Former Member]

SamPrice schrieb:
Hi,
The SR was closed as eService abandoned - which looks like it either wasn't submitted again after possible KB articles were offered, or there was something else going on.
[cut]

Yesterday: Virus submission and the same we found out here - BetaDats should detect, but still no detection.

Today: looks like                                                            3-905854453 is no more "resolved" opened again and "Work in Progress" - how nice... (Tnx, Sam?)

Gold Support called me today - 2 more Cases open, looks like - "Work in Progress"

Extra.dat is here! - still no detection (VSE8.7), but I will try tomorrow - maybe VSE8.5 will find it.

Nachricht geändert durch andydu (just got extra.dat) on 10.06.10 18:54:01 GMT+01:00

Nachricht geändert durch andydu (screenshot) on 10.06.10 19:02:33 GMT+01:00