I have a clients server which runs Small business Server 2003. It also has McAfee a/V on it, which is coming up saying that the PC is infected with the virus PatchedSFC in file C:\windows\system32\sfc_os
This is turning the print spooler service off all the time and they can not print on the already installed printers. I have tried Malwarebytes but it does not find the virus and McAfee finds it but will not delete it.
Has anyone else experienced this?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
McAfee states that with updated DAT files, their suite should remove the threat. That said, have you tried running your scans in Safe Mode? If not, you might give that a try.
You might also need to disable system restore and then run your scans.
Directions can be found here:
http://support.microsoft.c
http://www.surfright.nl/en
I wouldn't turn Off System Restore....there's nothing to gain turning it off while the system is infected, unless of course your only problem is virus located in System Restore which is not the case here.
Virut usually infects sfc_os.dll so it's possible that virut is present in the system and possible that other protected files are also infected(hopefully it's not the case).
Since sfc_os.dll is patched I assume Windows File Protection is already disabled.. or maybe not since McAfee still can't delete the patched file.
Have you tried just replacing sfc_os.dll with a clean copy?
Business Accounts
Answer for Membership
by: mbellettyPosted on 2009-10-22 at 02:27:21ID: 25632148
I have attached a screenshot of the McAfeee virus detection screen that comes up. This virus is stopping the SBS server from running its print spooler as well as not allowed USB external drivers to be shown.
Any help please would be appreciated on how to remove this.
Does anyone know of sfc_os.dll file. I dont think I can simply delete it?
Virus info picture file