W97M/Marker.T Virus found by Forefront on file server

[Sandy Wood]

I'm posting this here because I'm not getting any response in the Forefront
forums. (What happened over there? They used to be so responsive? Maybe the
new look) The Forefront client has discovered W97M/Marker.T on one of my file
servers. I've chosen to have it removed by FCS and it's now in a state of
"Taking Actions....". This has been going on for a hour now and the System
Event log is filling up with FCSAM Information events every 15 or so seconds
saying FCS is taking action. How long should I wait for this to finish?
--
Sandy Wood
Orange County District Attorney

 

[PA Bear [MS MVP]]

Contact Forefront Support: You (or rather, your employer) is paying for it.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Sandy Wood wrote:
> I'm posting this here because I'm not getting any response in the
> Forefront
> forums. (What happened over there? They used to be so responsive? Maybe
> the
> new look) The Forefront client has discovered W97M/Marker.T on one of my
> file servers. I've chosen to have it removed by FCS and it's now in a
> state
> of "Taking Actions....". This has been going on for a hour now and the
> System Event log is filling up with FCSAM Information events every 15 or
> so
> seconds saying FCS is taking action. How long should I wait for this to
> finish?

 

[PA Bear [MS MVP]]

PS: Have you tried posting to microsoft.public.security.forefront newsgroup?

PA Bear [MS MVP] wrote:
> Contact Forefront Support: You (or rather, your employer) is paying for
> it.
>
> Sandy Wood wrote:
>> I'm posting this here because I'm not getting any response in the
>> Forefront
>> forums. (What happened over there? They used to be so responsive? Maybe
>> the
>> new look) The Forefront client has discovered W97M/Marker.T on one of my
>> file servers. I've chosen to have it removed by FCS and it's now in a
>> state
>> of "Taking Actions....". This has been going on for a hour now and the
>> System Event log is filling up with FCSAM Information events every 15 or
>> so
>> seconds saying FCS is taking action. How long should I wait for this to
>> finish?

 

[Sandy Wood]

Yes, but only the server-side. They won't support our client
questions......have to love it.....
--
Sandy Wood
Orange County District Attorney


"PA Bear [MS MVP]" wrote:

> Contact Forefront Support: You (or rather, your employer) is paying for it.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> AumHa VSOP & Admin http://aumha.net
> DTS-L http://dts-l.net/
>
> Sandy Wood wrote:
> > I'm posting this here because I'm not getting any response in the
> > Forefront
> > forums. (What happened over there? They used to be so responsive? Maybe
> > the
> > new look) The Forefront client has discovered W97M/Marker.T on one of my
> > file servers. I've chosen to have it removed by FCS and it's now in a
> > state
> > of "Taking Actions....". This has been going on for a hour now and the
> > System Event log is filling up with FCSAM Information events every 15 or
> > so
> > seconds saying FCS is taking action. How long should I wait for this to
> > finish?
>
>

 

[Sandy Wood]

Yes....lately my posts have just sat there...maybe the new forum style?
--
Sandy Wood
Orange County District Attorney


"PA Bear [MS MVP]" wrote:

> PS: Have you tried posting to microsoft.public.security.forefront newsgroup?
>
> PA Bear [MS MVP] wrote:
> > Contact Forefront Support: You (or rather, your employer) is paying for
> > it.
> >
> > Sandy Wood wrote:
> >> I'm posting this here because I'm not getting any response in the
> >> Forefront
> >> forums. (What happened over there? They used to be so responsive? Maybe
> >> the
> >> new look) The Forefront client has discovered W97M/Marker.T on one of my
> >> file servers. I've chosen to have it removed by FCS and it's now in a
> >> state
> >> of "Taking Actions....". This has been going on for a hour now and the
> >> System Event log is filling up with FCSAM Information events every 15 or
> >> so
> >> seconds saying FCS is taking action. How long should I wait for this to
> >> finish?
>
>

 

[PA Bear [MS MVP]]

Sounds like you may be confusing the Forefront newsgroup
(microsoft.public.security.forefront) with the Forefront forums, Sandy =>
http://forums.microsoft.com/forefront/default.aspx?siteid=41

EDIT: Maybe not. Looks like those forums were moved in late May but...


Sandy Wood wrote:
> Yes....lately my posts have just sat there...maybe the new forum style?
>
>> PS: Have you tried posting to microsoft.public.security.forefront
>> newsgroup?
>>
>> PA Bear [MS MVP] wrote:
>>> Contact Forefront Support: You (or rather, your employer) is paying for
>>> it.
>>>
>>> Sandy Wood wrote:
>>>> I'm posting this here because I'm not getting any response in the
>>>> Forefront
>>>> forums. (What happened over there? They used to be so responsive? Maybe
>>>> the
>>>> new look) The Forefront client has discovered W97M/Marker.T on one of
>>>> my
>>>> file servers. I've chosen to have it removed by FCS and it's now in a
>>>> state
>>>> of "Taking Actions....". This has been going on for a hour now and the
>>>> System Event log is filling up with FCSAM Information events every 15
>>>> or
>>>> so
>>>> seconds saying FCS is taking action. How long should I wait for this to
>>>> finish?

 

[PA Bear [MS MVP]]

Nevermind. I see that you had been using (TechNet) Forefront Forums:
http://forums.microsoft.com/ForeFront/Search/Search.aspx?words=&CSVUserID=MTgwMzYx&SiteID=41

Try the newsgroup?


PA Bear [MS MVP] wrote:
> Sounds like you may be confusing the Forefront newsgroup
> (microsoft.public.security.forefront) with the Forefront forums, Sandy =>
> http://forums.microsoft.com/forefront/default.aspx?siteid=41
>
> EDIT: Maybe not. Looks like those forums were moved in late May but...
>
>
> Sandy Wood wrote:
>> Yes....lately my posts have just sat there...maybe the new forum style?
>>
>>> PS: Have you tried posting to microsoft.public.security.forefront
>>> newsgroup?
>>>
>>> PA Bear [MS MVP] wrote:
>>>> Contact Forefront Support: You (or rather, your employer) is paying for
>>>> it.
>>>>
>>>> Sandy Wood wrote:
>>>>> I'm posting this here because I'm not getting any response in the
>>>>> Forefront
>>>>> forums. (What happened over there? They used to be so responsive?
>>>>> Maybe
>>>>> the
>>>>> new look) The Forefront client has discovered W97M/Marker.T on one of
>>>>> my
>>>>> file servers. I've chosen to have it removed by FCS and it's now in a
>>>>> state
>>>>> of "Taking Actions....". This has been going on for a hour now and the
>>>>> System Event log is filling up with FCSAM Information events every 15
>>>>> or
>>>>> so
>>>>> seconds saying FCS is taking action. How long should I wait for this
>>>>> to
>>>>> finish?

 

[Sandy Wood]

Yes, I'm sure I am. The Forefront forum I posted my question to is at

http://forums.technet.microsoft.com/en-US/ForefrontclientMTR/threads/


--
Sandy Wood
Orange County District Attorney


"PA Bear [MS MVP]" wrote:

> Sounds like you may be confusing the Forefront newsgroup
> (microsoft.public.security.forefront) with the Forefront forums, Sandy =>
> http://forums.microsoft.com/forefront/default.aspx?siteid=41
>
> EDIT: Maybe not. Looks like those forums were moved in late May but...
>
>
> Sandy Wood wrote:
> > Yes....lately my posts have just sat there...maybe the new forum style?
> >
> >> PS: Have you tried posting to microsoft.public.security.forefront
> >> newsgroup?
> >>
> >> PA Bear [MS MVP] wrote:
> >>> Contact Forefront Support: You (or rather, your employer) is paying for
> >>> it.
> >>>
> >>> Sandy Wood wrote:
> >>>> I'm posting this here because I'm not getting any response in the
> >>>> Forefront
> >>>> forums. (What happened over there? They used to be so responsive? Maybe
> >>>> the
> >>>> new look) The Forefront client has discovered W97M/Marker.T on one of
> >>>> my
> >>>> file servers. I've chosen to have it removed by FCS and it's now in a
> >>>> state
> >>>> of "Taking Actions....". This has been going on for a hour now and the
> >>>> System Event log is filling up with FCSAM Information events every 15
> >>>> or
> >>>> so
> >>>> seconds saying FCS is taking action. How long should I wait for this to
> >>>> finish?
>
>

 

[Sandy Wood]

Not yet. I'll give them a try too. Wow, alot of security forums!
--
Sandy Wood
Orange County District Attorney


"PA Bear [MS MVP]" wrote:

> Nevermind. I see that you had been using (TechNet) Forefront Forums:
> http://forums.microsoft.com/ForeFront/Search/Search.aspx?words=&CSVUserID=MTgwMzYx&SiteID=41
>
> Try the newsgroup?
>
>
> PA Bear [MS MVP] wrote:
> > Sounds like you may be confusing the Forefront newsgroup
> > (microsoft.public.security.forefront) with the Forefront forums, Sandy =>
> > http://forums.microsoft.com/forefront/default.aspx?siteid=41
> >
> > EDIT: Maybe not. Looks like those forums were moved in late May but...
> >
> >
> > Sandy Wood wrote:
> >> Yes....lately my posts have just sat there...maybe the new forum style?
> >>
> >>> PS: Have you tried posting to microsoft.public.security.forefront
> >>> newsgroup?
> >>>
> >>> PA Bear [MS MVP] wrote:
> >>>> Contact Forefront Support: You (or rather, your employer) is paying for
> >>>> it.
> >>>>
> >>>> Sandy Wood wrote:
> >>>>> I'm posting this here because I'm not getting any response in the
> >>>>> Forefront
> >>>>> forums. (What happened over there? They used to be so responsive?
> >>>>> Maybe
> >>>>> the
> >>>>> new look) The Forefront client has discovered W97M/Marker.T on one of
> >>>>> my
> >>>>> file servers. I've chosen to have it removed by FCS and it's now in a
> >>>>> state
> >>>>> of "Taking Actions....". This has been going on for a hour now and the
> >>>>> System Event log is filling up with FCSAM Information events every 15
> >>>>> or
> >>>>> so
> >>>>> seconds saying FCS is taking action. How long should I wait for this
> >>>>> to
> >>>>> finish?
>
>

 

[PA Bear [MS MVP]]

I've pinged an MS contact for information on where the forums might be
located & accessed now.

Newsgroups are NOT forums.


Sandy Wood wrote:
> Not yet. I'll give them a try too. Wow, alot of security forums!
>
>> Nevermind. I see that you had been using (TechNet) Forefront Forums:
>> http://forums.microsoft.com/ForeFront/Search/Search.aspx?words=&CSVUserID=MTgwMzYx&SiteID=41
>>
>> Try the newsgroup?
>>
>>
>> PA Bear [MS MVP] wrote:
>>> Sounds like you may be confusing the Forefront newsgroup
>>> (microsoft.public.security.forefront) with the Forefront forums, Sandy
>>> =>
>>> http://forums.microsoft.com/forefront/default.aspx?siteid=41
>>>
>>> EDIT: Maybe not. Looks like those forums were moved in late May but...
>>>
>>>
>>> Sandy Wood wrote:
>>>> Yes....lately my posts have just sat there...maybe the new forum style?
>>>>
>>>>> PS: Have you tried posting to microsoft.public.security.forefront
>>>>> newsgroup?
>>>>>
>>>>> PA Bear [MS MVP] wrote:
>>>>>> Contact Forefront Support: You (or rather, your employer) is paying
>>>>>> for
>>>>>> it.
>>>>>>
>>>>>> Sandy Wood wrote:
>>>>>>> I'm posting this here because I'm not getting any response in the
>>>>>>> Forefront
>>>>>>> forums. (What happened over there? They used to be so responsive?
>>>>>>> Maybe
>>>>>>> the
>>>>>>> new look) The Forefront client has discovered W97M/Marker.T on one
>>>>>>> of
>>>>>>> my
>>>>>>> file servers. I've chosen to have it removed by FCS and it's now in
>>>>>>> a
>>>>>>> state
>>>>>>> of "Taking Actions....". This has been going on for a hour now and
>>>>>>> the
>>>>>>> System Event log is filling up with FCSAM Information events every
>>>>>>> 15
>>>>>>> or
>>>>>>> so
>>>>>>> seconds saying FCS is taking action. How long should I wait for this
>>>>>>> to
>>>>>>> finish?

 

[Sandy Wood]

Man, I can't find the newsgroup out there...is it hidden somewhere?
--
Sandy Wood
Orange County District Attorney


"Sandy Wood" wrote:

> I'm posting this here because I'm not getting any response in the Forefront
> forums. (What happened over there? They used to be so responsive? Maybe the
> new look) The Forefront client has discovered W97M/Marker.T on one of my file
> servers. I've chosen to have it removed by FCS and it's now in a state of
> "Taking Actions....". This has been going on for a hour now and the System
> Event log is filling up with FCSAM Information events every 15 or so seconds
> saying FCS is taking action. How long should I wait for this to finish?
> --
> Sandy Wood
> Orange County District Attorney

 

[PA Bear [MS MVP]]

Via the clunky web-interface:
http://www.microsoft.com/communitie...t.aspx?dg=microsoft.public.security.forefront

Via your NNTP newsreader (e.g., OE Windows Mail Windows Live Mail):
news://msnews.microsoft.com/microsoft.public.security.forefront
--
~PA Bear


Sandy Wood wrote:
> Man, I can't find the newsgroup out there...is it hidden somewhere?
>
>> I'm posting this here because I'm not getting any response in the
>> Forefront
>> forums. (What happened over there? They used to be so responsive? Maybe
>> the
>> new look) The Forefront client has discovered W97M/Marker.T on one of my
>> file servers. I've chosen to have it removed by FCS and it's now in a
>> state of "Taking Actions....". This has been going on for a hour now and
>> the System Event log is filling up with FCSAM Information events every 15
>> or so seconds saying FCS is taking action. How long should I wait for
>> this
>> to finish? --
>> Sandy Wood
>> Orange County District Attorney

 

[Johan Blom, TrueSec]

Hi Sandy!

I used to post alot on the old Forefront forum (and will continue in the new
forefront forum) however i must say that i don't like the new look and feel
of the forum. I used to be on the top answers list (place 1 - 3). Another
thing with the new forum is that it's alot harder to see if there are new
unanswered questions. In the old forum it was easy to get a quick overview.
I promise i'll be more active on the new forum from now on (just got back
from a month of vacation).

Keep the faith Sandy

/Johan
--
MCSE, forefront spec | www.msforefront.com


"PA Bear [MS MVP]" wrote:

> Via the clunky web-interface:
> http://www.microsoft.com/communitie...t.aspx?dg=microsoft.public.security.forefront
>
> Via your NNTP newsreader (e.g., OE Windows Mail Windows Live Mail):
> news://msnews.microsoft.com/microsoft.public.security.forefront
> --
> ~PA Bear
>
>
> Sandy Wood wrote:
> > Man, I can't find the newsgroup out there...is it hidden somewhere?
> >
> >> I'm posting this here because I'm not getting any response in the
> >> Forefront
> >> forums. (What happened over there? They used to be so responsive? Maybe
> >> the
> >> new look) The Forefront client has discovered W97M/Marker.T on one of my
> >> file servers. I've chosen to have it removed by FCS and it's now in a
> >> state of "Taking Actions....". This has been going on for a hour now and
> >> the System Event log is filling up with FCSAM Information events every 15
> >> or so seconds saying FCS is taking action. How long should I wait for
> >> this
> >> to finish? --
> >> Sandy Wood
> >> Orange County District Attorney
>
>