Running another update after 3918 fixed it here.

Ran a manual update at 1:37amEST here appears to have fixed all the FP for me.

It still seems to be 3918, but logs show "program modules have been updated" when I ran it. Rescan after that on all the quarantined files and everything in system32 seem to come up clean.

Thanks for the scare. What a mess on sunday night.


Time log:

3/9/2009 12:51:05 AM Kernel Virus signature database successfully updated to version 3918 (20090309).

Autodetects after this like everyone else:
3/9/2009 12:55:19 AM Startup scanner file C:\WINDOWS\system32\dllhost.exe a variant of Win32/Kryptik.JX trojan cleaned by deleting
<several others, and tons on a scan of all system32>

Manual udpate:
3/9/2009 1:37:57 AM Kernel The program modules have been updated.
Then restored/rescanned and clean:
3/9/2009 1:39:42 AM C:\WINDOWS\system32\ 8514 0 0 Completed

 

Got the same update. Restored all the files that had been quarantined and rescanned the System32 folder. No false positives now. Looks like they fixed the problem!

 

What is the approperiate way to do this across all managed NOD32 AV hosts?

Is there a CLI command that might be pushed out via the Admin tool?

Anyone?