BigFix User Group

Hi Barry,

eTrust is the engine that powers the BigFix AntiVirus and I spent some time looking through their AV information at http://www.ca.com/us/securityadvisor/default.aspx , but I didn't find anything that looked like this trojan. This might mean that the eTrust engine doesn't know about this trojan yet.

We can escalate this issue to eTrust and let you know, but I think it makes sense for you to start a BigFix case so we can track this and communicate with you properly.

Thanks,
Ben

Hey Barry,

Actually, it looks like eTrust does have a definition for this trojan, but it is called DANMEC and it is here: http://www.ca.com/securityadvisor/pest/ … =453112813

However, this trojan is considered Spyware and so it is detected by BigFix AntiSpyware and not BigFix AntiVirus (which explains why you did not see it detected). To remove this trojan and all other spyware, you need to use the AntiPest software.

Until you can get AntiPest in place, I wrote a Fixlet that will detect and remove this particular trojan so you can help deal with this problem now. It is attached to this post (you can only see attachments if you are logged into the forum).

I couldn't test the Fixlet and I am not sure it will remove every single piece of the trojan so let me know what you find.

Ben

The Fixlet is great at detecting the infected machines. Unfortunately, we need to do the remediation by hand because it requires booting into Safe Mode.