False Positive AMalum detection with CA Anti-Virus

I have CA Anti-Virus and Windows XP with Service Pack 3 (SP3). My system keeps telling me that I have been infected with the Win32/AMalum virus and when I quarantine the files, Windows then tells me I need to replace needed system files and asks for my Windows XP CDROM. When the files are replaced, the "loop" starts over again with CA telling me I am infected! What gives?

This question was answered on July 10, 2009. Much of the information contained herein may have changed since posting.

---

Over the last few days many users of CA Anti-Virus have been experiencing an issue with clearing a reported virus within the CA software called the AMalum virus The fix detailed below was created by CA.

This information is relevant ONLY for customers who are running CA Anti-Virus AND are getting messages regarding a Win32/AMalum virus or if you are being asked to insert a Windows SP3 CD to repair some files.

This information does NOT impact anyone else and does not need to be followed if you are not having these symptoms.

To fix this issue, take the following steps:

1 Open CA – You do this by double clicking on the CA Shield Icon in the bottom right corner of your screen down by your PC’s Clock.

2 Update CA – Click on the update button This will download the latest list of threats & fixes.

3 Open CA Anti-Virus advanced settings – Not anti-spyware…anti-Virus, you may have to click on CA-Anti-Virus to see the link.

4 Open the quarantine – you do this by clicking on the button on the left, now the fun part,

a Look for items in the list dated AFTER JULY 4th, ignore any others.

b Identify the following files, there may be one or several of each:

i Net.exe

ii Netsh.exe

iii Verclsid.exe

iv Reg.exe

c We want to restore EACH of these files by clicking on the restore button above the file list for each file Leave the “attempt to clean…” tick box blank.

d Click OK to accept/confirm the restoration of these files…repeat for each file, we need to restore them one at a time.

5 Run a Virus scan – Click on Overview and then scan my computer for viruses.

6 Verify the scan found nothing.

This should bring your system back to normal operation Additional information can be found at at this website.

About the author

Posted by Brandon of Data Doctors on July 10, 2009

Need Help with this Issue?

We help people with technology! It's what we do.
Contact or Schedule an Appointment with a location for help!