Automatic Updates keeps incorrectly diagnosing Mydoom, Zindos, Doomjuice infection

Hello everyone,

I am hoping someone out there can help me solve this problem. Twice
automatic updates have downloaded the Mydoom, Zindos and Doomjuice
removal tool, saying that my system is most likely infected by this
worm.

I believe that this is a false positive, because I have Symantec
Antivirus with up to date definitions running. It runs a full system
scan every night and does not find anything. I have also downloaded and
ran Microsoft's Malicious software tool. Again, this tool found
nothing. Lastly, I have looked at the registry, hosts file, etc for any
signs of these worms, but have not found anything.

What could be causing Windowsupdate to incorrectly identify my machine
as being infected with one of these worms?

Would you write down the "verbatim" text you're getting about infections
from Windows Update, and post that back.

Norton/Symantec AV will not, by itself, catch all malware --- other than the
viruses it has signatures for in "your local" definitions in NAV.

When it comes to cleaning up on malware, you cannot rely on only 1 tool.
I recommend an article at Aumha.org on ways to cleanup parasites.
Follow the quick-fix protocol.
http://aumha.org/a/quickfix.htm

Here are 2 tools from SysInternals that may help you get an insight on
what's running on your system, including any "malware" startups.
Autoruns (checks & shows what's set to auto-load at Windows startup)
http://www.sysinternals.com/ntw2k/fr...autoruns.shtml

Process Explorer http://www.sysinternals.com/ntw2k/fr.../procexp.shtml

You likely will have to do cleanups in Safe mode, once you have downloaded
current definitions.
You should even use Safe Mode with Networking to do all this work.
Press F8 Function key as the pc is booting up so that you can see bootup
choices.


--
Maurice N
MVP Windows - Shell / User
---
"XxLicherxX" wrote
> Hello everyone,
>
> I am hoping someone out there can help me solve this problem. Twice
> automatic updates have downloaded the Mydoom, Zindos and Doomjuice
> removal tool, saying that my system is most likely infected by this
> worm.
>
> I believe that this is a false positive, because I have Symantec
> Antivirus with up to date definitions running. It runs a full system
> scan every night and does not find anything. I have also downloaded and
> ran Microsoft's Malicious software tool. Again, this tool found
> nothing. Lastly, I have looked at the registry, hosts file, etc for any
> signs of these worms, but have not found anything.
>
> What could be causing Windowsupdate to incorrectly identify my machine
> as being infected with one of these worms?
>