Virus/Spyware Detected

Hi Faisal Raza1,

Can you please provide me the following details so that I can assist you accordingly.

* Is it seen in multiple clients or from a single computer? I would specifically like to know if is it seen on the computer using Auto CAD application?

* Also can you confirm the detection location of the detection?

Hello Mani,

Yes this has been triggered in multiple machines and not all the machines have Auto CAD.

I've attached few of the machines for Ref. only.

Regards

Faisal

Hello Faisal,

not all detections are created equal and consequently there's not a one-size-fits-all action.

Mal/BredoZip-B is a generically detected zip archive - the name invoice.zip isn't really trustworthy, the location suggests these are attachments
W32/AutoRun-BUC is an "old" worm, likely in some "backed up" content
C2/Generic-B indicates possibly rogue traffic, please see the analysis for details

Christian

I've the following infections and need the exact cleaning and verification procedure for worry free life. The Virus / Spyware names and the links pointing to.

Please advise with your expertise.

Mal/Wonton-BB        www.sophos.com/.../search-results.aspx
AL/Bursted-AJ        www.sophos.com/.../search-results.aspx
AL/Bursted-CL        www.sophos.com/.../search-results.aspx
Troj/JSMiner-L        www.sophos.com/.../search-results.aspx
W32/Chir-B        www.sophos.com/.../W32~Chir-B.aspx
AL/iShiravi-A        www.sophos.com/.../search-results.aspx
SearchProtect        www.sophos.com/.../search-results.aspx
Android Airpush        www.sophos.com/.../search-results.aspx
Mal/BredoZp-B        www.sophos.com/.../Mal~BredoZp-B.aspx
Mal/Generic-S        www.sophos.com/.../Mal~Generic-S.aspx
Mal/Kryptik-BH        https://www.sophos.com/en-us/search-results.aspx?search=Mal/Kryptik-BH&refine=7edf01e4de3c4c8791a56ba6ce685d09

Thanks and Best Regards

Faisal

Hello Faisal,

as you have included the analyses I guess you have also read them. Did you follow the advice given (e.g. to send samples for the generic detections - especially for Mal/Generic-S) on the analysis page and the linked articles. Admittedly the one for PE infections no longer exists (can't say why) but I assume you don't have an outbreak and the common procedures (scheduled scan, using the local Quarantine Manager, manual delete) apply. Some detections make me wonder whether you cooperate with an IT Jurassic Park. Seriously - where do you users get all this stuff from?

If the instructions aren't clear or if you're unsure how to apply them please be specific (and perhaps Malware Questions is the better forum to discuss some of these things). Please also note that it's not possible to give more than some general advice in response to a list of threat names. There's no miracle cure known only to adepts and if the common procedures prove insufficient an effective approach requires context and details.

Christian

Hello Faisal,

as you have included the analyses I guess you have also read them. Did you follow the advice given (e.g. to send samples for the generic detections - especially for Mal/Generic-S) on the analysis page and the linked articles. Admittedly the one for PE infections no longer exists (can't say why) but I assume you don't have an outbreak and the common procedures (scheduled scan, using the local Quarantine Manager, manual delete) apply. Some detections make me wonder whether you cooperate with an IT Jurassic Park. Seriously - where do you users get all this stuff from?

If the instructions aren't clear or if you're unsure how to apply them please be specific (and perhaps Malware Questions is the better forum to discuss some of these things). Please also note that it's not possible to give more than some general advice in response to a list of threat names. There's no miracle cure known only to adepts and if the common procedures prove insufficient an effective approach requires context and details.

Christian