Virus detected won't clear

Hello Weeboo,

if you delete a computer from the console it is just hidden - keeping all its history and most of its status at the time of deletion. When it "comes back" with the same name this "archived" computer is simply unhidden. If you did not acknowledge this alert before you deleted the computer from SEC it might reappear together with the computer.
Please check the timestamp of the alert - if it's from before the rebuild simply acknowledge it.

Christian 

QC said:

Hello Weeboo,

if you delete a computer from the console it is just hidden - keeping all its history and most of its status at the time of deletion. When it "comes back" with the same name this "archived" computer is simply unhidden. If you did not acknowledge this alert before you deleted the computer from SEC it might reappear together with the computer.
Please check the timestamp of the alert - if it's from before the rebuild simply acknowledge it.

Christian 

 

OK We have 3 PC's that were detected as having coinhive PUA last week - they have all been rebuilt - so ARE clean

but they are still showing the infection - in the error box in Enterprise console

I have acknowledged the infection and they disappeared from the error box, yesterday - but are now back in the same place

How do I remove them from the error box ?

Hello Weeboo,

are now back
with a recent timestamp? Is it the C2/Generic-B alert that's returning or the Coinhive PUA?
The alert contains a path (more details might be in the endpoint's SAV.txt log), please check if the given location is indeed still clean.

Christian

QC said:

Hello Weeboo,

are now back
with a recent timestamp? Is it the C2/Generic-B alert that's returning or the Coinhive PUA?
The alert contains a path (more details might be in the endpoint's SAV.txt log), please check if the given location is indeed still clean.

Christian

 

Coinhive - but the PC has been rebuilt - So why is it still showing ?

One of the other PC's that was infected with coinhive last week (that was also rebuilt) - NOW has a double infection of generic PUA PO and DEALPLY UPDATER !!

Hello Weeboo,

why is it still showing?
could you perhaps provide a screenshot of the alert? If you did acknowledge it and it reappeared its timestamp should be more recent than the rebuild.

NOW has a double infection
User downloading a something? If I download aQuestionableSoftware.exe on one day, a detection is triggered, and the PC is subsequently rebuilt - what will prevent me from downloading the same junk the next day?

Christian

The timestamp is still the original infection .....

The timestamp is still the original infection .....

Hello Weeboo,

I see. Did you right-click on the computer, select Resolve Alerts and Errors ... and acknowledge the alert there?

Christian

They were showing as ERRORS rather than ALERTS - Which is where the confusion started

now cleared -

thanks

QC said:

Hello Weeboo,

I see. Did you right-click on the computer, select Resolve Alerts and Errors ... and acknowledge the alert there?

Christian