Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 1781 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

FakeAV - Microsoft Security Essentials

chadwick

I'm just curious if anybody else is getting hit pretty hard by this one? For us it's showing up as mstsc.exe and hotfix.exe. Sophos takes care of it but the delay between detection and cleanup allows the Fake Microsoft Security Essentials window to pop up.

:5299


This thread was automatically locked due to age.
Parents
  • 0

    Our organization just got the same virus/trojan on a laptop, seemingly after visiting rouge website in IE8... however, on further investigation, there may even have been a previous issue with a fake windows update.  The concern here is that sophos did not stop the virus/trojan from running and the virus/trojan was able to turn sophos protection off and shut it down.  We are in the process of cleaning the machine as the virus seems specific to a user account, so running sophos in safe mode under the admin account is working.

    Since sophos did not catch this upfront, are there additional manual steps that need to be taken to ensure the virus is completely removed?

    :5316
Reply
  • 0

    Our organization just got the same virus/trojan on a laptop, seemingly after visiting rouge website in IE8... however, on further investigation, there may even have been a previous issue with a fake windows update.  The concern here is that sophos did not stop the virus/trojan from running and the virus/trojan was able to turn sophos protection off and shut it down.  We are in the process of cleaning the machine as the virus seems specific to a user account, so running sophos in safe mode under the admin account is working.

    Since sophos did not catch this upfront, are there additional manual steps that need to be taken to ensure the virus is completely removed?

    :5316
Children
No Data
Unfiltered HTML