jbryan
join:2004-11-30
White, PA
 ·Verizon BroadbandA..
| Infected file
I got the following message from my CA Anti Virus real time scanner progrm today. I ran a full system scan and CA does not find it. I tried searching for this on c drive and cannot find it anywhere. Any suggestions?
3/23/2008 13:39:23 PM File infection: \Device\HarddiskVolumeShadowCopy6\PAGEFILE.SYS is infected with JS/Lame.A virus. |
|
anon101
@cox.net | Maybe CA AV removed it initially. Thats why you did not find it again on the scan. I dont have this product so cant offer much more help. Are there any logs/quarantines/etc to look at? |
|
Kiwi
Premium
join:2003-05-26
USA
 ·Comcast
 ·Aristotle Internet
| Apparently is not a false positive...
"The malware determines the location of the current Windows folder by querying the operating system. The default installation location for the Windows directory for Windows 2000 and NT is C:\Winnt; for 95,98 and ME is C:\Windows; and for XP is C:\Windows.
%Temp% is a variable location and refers to the directory designated for temporary files. The malware determines the location of the current Temp folder by querying the operating system. A typical path is "C:\Documents and Settings\\Local Settings\Temp", or "C:\WINDOWS\TEMP".
If the current day is the 9th, it adds the following text to the infected file:
"This file is infected by Html.Lame!"
"What a virus!  "
Cheers |
|
