WIN32/AMalum.ZZNXU

[spud]

In the meantime, turn off realtime protection on your Antivirus and all the boxes for quarantine etc. Then restore the files and all should be fine. when the next update is downloaded re-tick these options and re-scan and it should be patched.

For now though, you will just have to managewithout an anti-virus till CA fix it. Not good enough but at least you will still be able to use your pc.

[Tartuga]

I deleted the quarantined file before I started researching this problem. I ran a CA update and another scan and the virus still showed up in a number of files. Is there anything I can do prior to CA fixing this problem.

[swag-nyc]

scanning with product version 8.4.0.28 gave me no problems so far

[underdog]

Based on Tartuga's actions (deleting one of the "infected" files) and the likelihood that others will also want to know, does anyone have any suggestions on where to get a fresh / clean copy of net.exe, netsh.exe, and the other specific files that have been tagged as infected?

[Hoekone]

Same problems here, i downloaded service pack 3 and tried to reinstall it (didnt have the disc) but CA anti virus keeps blocking the file wmiadap.exe and i cannot install service pack 3 to repair the corrupt or missing files. This is happening on 4 computers in the office. I think this is a CA anti virus problem as i got service pack 3 directly from windows website and it will not install, it was installed months ago no problems, but now ca is blocking it.

Heres some of the files its quarantining:

verclsid.exe - Win32/AMalum.ZZNRA
CCleaner - Win32/AMalum.ZZTLX I dont think this is related to sp3 but CCleaner shouldnt be picked up?)
net.exe - Win32/AMalum.ZZNPD
reg.exe - Win32/AMalum.ZZOAF
netsh.exe - Win32/AMalum.ZZOKH
net.exe - Win32/AMalum.ZZNPB
reg.exe - Win32/AMalum.ZZOAF
netsh.exe - Win32/AMalum.ZZOKH
wmiprvse.exe - Win32/AMalum.ZZOCR
wmiadap.exe - Win32/AMalum.ZZNXU
wmiadap.exe - Win32/AMalum.ZZNXU
verclsid.exe - Win32/AMalumZZNRA
wmiadap.exe - Win32/AMalum.ZZNXU
HFX69.tmp - Win32/AMalum.ZZNXU
HFX6A.tmp - Win32/AMalum.ZZNXU
HFX6B.tmp - Win32/AMalum.ZZNXU

These above are all quarantined.

[Hoekone]

Originally Posted by underdog

Based on Tartuga's actions (deleting one of the "infected" files) and the likelihood that others will also want to know, does anyone have any suggestions on where to get a fresh / clean copy of net.exe, netsh.exe, and the other specific files that have been tagged as infected?

I tried reinstalling Service pack 3 directly from windows and the viruses get picked up during installation and fails, i cannot reinstall SP3.

[swag-nyc]

Originally Posted by underdog

Based on Tartuga's actions (deleting one of the "infected" files) and the likelihood that others will also want to know, does anyone have any suggestions on where to get a fresh / clean copy of net.exe, netsh.exe, and the other specific files that have been tagged as infected?

winxp service pack 3
you might get windows update to fix it for you, but if that does not work you would have to slog through the windows website and find the downloadable version of sp3

I dont think restore will fix it if the file is deleted

I didnt look them all up, but for instance reg.exe is the command line version of regedit, not something you normally use. you can look them up to see if its worth the effort

[Hoekone]

im getting an error message after a rebbot before windows desktop shows saying reg.exe is missing and may cause it to be unstable.

And trying to reinstall sp3 doesnt work, well it isnt for me, can anyone else confirm?

[icflordlucan]

This is just absurd.
I have tuned off all but my email scanner...so now my system is essentially unprotected.
Fortunately, all the files are still in the quarantine folder, but I have multiple copies, when I new definition file comes in from CA I will restore the ones with the earliest deletion time.
If this doesn't fix it, I don't know what will. System restore to en earlier time perhaps (once quarantined files have been restored)?

[swag-nyc]

Originally Posted by Hoekone

I tried reinstalling Service pack 3 directly from windows and the viruses get picked up during installation and fails, i cannot reinstall SP3.

you'll need to disable the scanner in the options screen.

in short CA AV will mess up winXP machines running SP3, turn it off until its fixed and before you try to fix the damage done.

for office admins, you could manually exclude the files (provided the list doesnt continue to grow) until the fix comes, but you will still need to disable the Real Time Scanner before trying to fix SP3