False virus report with latest AV update
Mort Denison
Version: 4.0
After downloading and installing the latest AV definitions, I now get
a report from NU that I have a virus.
NU suggests I run AV SE.
I run AV 4.0 instead.
AV removes a word virus, w97m.vmpck1c, from a Word97 template.
NU still insists I have a virus. AV 4.0 does not find another one.
There's only one slight problem here.
The VB module removed from my word template is one of the three in
the template I wrote. Unless this particular macro can hide its VB
code in the VB editor, we've got a problem.
The problem is that at work we run Norton AV network software.
Just as soon as I distribute this template to, oh, 200 users, our
systems people are not going to be real pleased with me.
BTW, there's no mention, that I could find, of this virus in your
on-line encyclopedia.
LaVonne Perry [Symantec]
>systems people are not going to be real pleased with me.
>
>BTW, there's no mention, that I could find, of this virus in your
>on-line encyclopedia.
Hello Mort,
Thanks for writing.
I'd strongly urge you to get this template to our virus lab. It
sounds like we will need to modify our virus detection for
w97m.vmpck1c to keep it from false alerting on your template. This
virus was recently added to the Virus List, so it may not yet have
been added to the Virus Encyclopedia.
To submit a sample, use Notepad or some other editor to fill out the
SUBMIT.TXT file located at:
ftp://ftp.symantec.com/public/english_us_canada/antivirus_definitions/norton_antivirus/submit.txt
Make sure to include complete information or the sample will be
rejected. Then, make a copy of your NORMAL.DOT file, your PERSONAL.XLS
file, and any other suspicious documents. Follow the instructions at
the bottom of the INSTRUCT.TXT file for submitting file infecting
viruses to our Symantec Antivirus Research Center. The INSTRUCT.TXT
file is located at:
ftp://ftp.symantec.com/public/english_us_canada/antivirus_definitions/norton_antivirus/instruct.txt
The sample should be emailed to:
Let me know if I can be of further assistance.
Regards,
LaVonne Perry
Senior Support Analyst
Symantec Corporation
Please continue to post your messages to the public discussion group as
Symantec does not provide support via private e-mail. Thank you.
If you have difficulty getting a response, please read the following article:
http://service1.symantec.com/SUPPORT/sharedtech.nsf/docid/1998527114414
For free technical support newsletters, Knowledge Base support articles, our Online Support Genie, and FAQs, visit our Norton AntiVirus support page:
http://www.symantec.com/techsupp/nav.html
Personalize your technical support pages at: