And that's why I need to deploy SAV 10

As I was leaving work today, I glanced down at the blackberry and saw pages and pages of virus alerts. In outlook that is filtered to another folder so I dont see it. The virus alerts were coming once per minute from a file in the users temp internet files.

After going to dinner :) I came back and found that the file being detected was a running process. Since SAV versions earlier than 10 cant end the process, it just kept detecting it and being unable to do anything. I used pskill to take out the process and then used SAV to delete the file.

Interesting enough, this user is not a local administrator. However, she also was not added to the correct security group for our "managed user" group policy to apply so she was able to get this autorunning under her hkey_user etc etc windows current version run registry key.

The file was BubbleShotter15[1].com and it was detected as Backdoor.Sdbot. Only other thing on the system that was suspicious was Plaxo. I hate that program.