Running another update after 3918 fixed it here.

[kevinz]

Ran a manual update at 1:37amEST here appears to have fixed all the FP for me.

It still seems to be 3918, but logs show "program modules have been updated" when I ran it. Rescan after that on all the quarantined files and everything in system32 seem to come up clean.

Thanks for the scare. What a mess on sunday night.


Time log:

3/9/2009 12:51:05 AM Kernel Virus signature database successfully updated to version 3918 (20090309).

Autodetects after this like everyone else:
3/9/2009 12:55:19 AM Startup scanner file C:\WINDOWS\system32\dllhost.exe a variant of Win32/Kryptik.JX trojan cleaned by deleting
<several others, and tons on a scan of all system32>

Manual udpate:
3/9/2009 1:37:57 AM Kernel The program modules have been updated.
Then restored/rescanned and clean:
3/9/2009 1:39:42 AM C:\WINDOWS\system32\ 8514 0 0 Completed

[CellThree]

Got the same update. Restored all the files that had been quarantined and rescanned the System32 folder. No false positives now. Looks like they fixed the problem!

[CEllsworth]

What is the approperiate way to do this across all managed NOD32 AV hosts?

Is there a CLI command that might be pushed out via the Admin tool?

Anyone?