Question about attachments

[Contonso]

Hi there,

our virus scanner detected an infected file in one of the EV_CVT_Temp_ folders. This file was moved immidiately to the quarantine by the scanner software. If I am correct these CVT_Temp folders are used for archiving as well for manual archiving.

My question is if I have any chance to find out who of our users has archived this infected file? I checked all available EV logs but could not find any username or file.

Is there propably a chance to find out something in the EV DBs? Unfortunately we are not using Journaling.

EV version is 10.01 and we are running Exchange 2010.

Regards

[Rob_Wilcox1]

First of all, which folder *exactly* is it you are referring to?

Secondly, chances are it's NOT an infected file, but shows 'signatures' that are similar to a virus, but really, they're not..  antivirus gets confused. This technote might help:

http://www.symantec.com/business/support/index?page=content&id=TECH48856

[Contonso]

Hi,

thanks for reply. We are using Symantec Endpoint Protection and it detected the file as a Trojan.Gen

It is folder EV_CVT_Temp_2.

Regards

[Rob_Wilcox1 · Accepted solution]

Okay that's a super-generic detection, as I said, it's not a virus.  I'd bet good money on it.

Where is that folder located? The full path I mean.

[Contonso]

The Full path is: C:\Users\evltadmin\AppData\Local\Temp\EV_CVT_Temp_2

[Rob_Wilcox1]

Okay, well %temp% for the Vault Service Account should be excluded from AV scanning.

[Contonso]

I just done this already.

Many Thanks

Regards,

Contonso

[Rob_Wilcox1]

Glad to help.