W32.Wecorl.a (or Variant) Infection across enterprise

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View


My company has just been hit with what seems to be a massive infection
of a new variant of the W32.wecorl.a virus. It has spread and infected
a large number of systems in our HQ office and for our remote users.

Users boot up and log in then they get a notice from McAfee that an
infection was detected and the system shuts down and reboots.

Systems are primarily WinXP with up-to-date patches and running McAfee
VirusScan Enterprise with updated Defs (at least to yesterday)

Is anyone else dealing with this? Any ideas on effective widespread
removal techniques?

Re: W32.Wecorl.a (or Variant) Infection across enterprise



This is a false positive.

Check the McAfee Community site here: http://community.mcafee.com/message/125576

Check the McAfee OFFICIAL response here:
http://community.mcafee.com/message/125576

Re: W32.Wecorl.a (or Variant) Infection across enterprise



This is a false positive.

Check the McAfee Community site here: http://community.mcafee.com/message/125576

Check the McAfee OFFICIAL response here:
http://home.mcafee.com/VirusInfo/VirusProfile.aspx?key=265240

Re: W32.Wecorl.a (or Variant) Infection across enterprise




| My company has just been hit with what seems to be a massive infection
| of a new variant of the W32.wecorl.a virus. It has spread and infected
| a large number of systems in our HQ office and for our remote users.

| Users boot up and log in then they get a notice from McAfee that an
| infection was detected and the system shuts down and reboots.

| Systems are primarily WinXP with up-to-date patches and running McAfee
| VirusScan Enterprise with updated Defs (at least to yesterday)

| Is anyone else dealing with this? Any ideas on effective widespread
| removal techniques?

McAfee f**ked this one up !

The 5959 dat files have been released early due to a DAT Issue Emergency with
the 5958 DAT
Files.

The reason for this DAT Issue Emergency is a 'W32/Wecorl.a' False Positive in
5958 DAT.

The various 5959 dat file packages can be found at

http://www.mcafee.com/apps/downloads/security_updates/dat.asp

http://www.us-cert.gov/current/index.html#mcafee_dat_5958_issues


--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Re: W32.Wecorl.a (or Variant) Infection across enterprise



Quoted text here. Click to load it

Yet another DoS made possible by security software. :o)



Re: W32.Wecorl.a (or Variant) Infection across enterprise





Quoted text here. Click to load it










| Yet another DoS made possible by security software. :o)


Bwahahahahahahahahahaha  :-)

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Re: W32.Wecorl.a (or Variant) Infection across enterprise



Reminds me something that happened back in floppies days.   McAfee was
giving a false positive on an install disk (and yes, it was a false
positive) and when I went on vacation a field engineer came in to do
maintenance work, put the floppy in, got the virus warning and
promptly wiped out the hard drive (as the corporate office told him to
do).      I had all the files backed up, so I just had to install a
few programs and copy the files back.     Still a brain dead anti-
virus + brain dead F.E. = not a good thing.

On a side note, no idea if the work place started rolling out McAfee
yet.   Still have Trend on the computers by me.

Site Timeline