Norton for Mac

[menditto]

Norton Internet Security 5 for Mac. Version 12.1 (54)

Infostealer.Bancos reported every 5 minutes when browsing the web to trusted websites like norton.com. The file is automatically deleted and moved to /Library/Application Support/Symantec/AntiVirus/QTFiles. 

Is this a false-positive or is there a way to determine the source, i.e., browser, email, other computers on the network? 

Thanks.

[x190av]

---

menditto wrote:

Norton Internet Security 5 for Mac. Version 12.1 (54)

Infostealer.Bancos reported every 5 minutes when browsing the web to trusted websites like norton.com. The file is automatically deleted and moved to /Library/Application Support/Symantec/AntiVirus/QTFiles. 

Is this a false-positive or is there a way to determine the source, i.e., browser, email, other computers on the network? 

Thanks.

---

Most likely it arrived as an email attachment. It's a made-for-windows Trojan. If you do find  this attachment, do not open or reply to it.

http://www.symantec.com/security_response/writeup.jsp?docid=2003-071710-2826-99&tabid=2

[menditto]

I emptied trash and spam and the scanner continues to alert and delete it.  Is there a way to determine the original message or file source, so I can delete the email that contains it? Thanks.

[Lee_G]

There is a known problem with a migration tool that can cause this.  if you do the following it should stop the repeated detections:

1. Run the Terminal application (from /Applications/Utilities/Terminal)

2. Enter this command:

sudo rm /usr/bin/MigrateQTF

(you will be prompted for your admin password, enter it and hit return)

[menditto]

Thanks. What's the migration tool for?

I see it in the manifest.

Will product updates automatically recreate the file and reintroduce the behavior?

When is it scheduled to be fixed?

Thanks a bunch for helping me out. :)

[Lee_G · Accepted solution]

The tool is supposed to move files from your NAV 11 quarantine into the NAV 12 quarantine (the format changed between versions).  Unfortunately, in some cases, there's a flaw that causes an incorrect restore to the QTFiles file you saw, and since this is unexpected, the tool continues trying to migrate the old quarantine and reproduces that file.

Subsequent updates for NAV should only recreate the tool once it's fixed.  I can't give you an exact date but I expect it to be part of the next update.