gkidd

Thanks for the quick follow up!! Much appreciated.

I'm with you Joe - same files/keys as you have listed above. Multiple endpoints on various network segments = exact same alarm.

Multiple Backdoor.NanoCore alerts in my organization as well. Started this morning after daily scan.

Steady stream of clients on my network reporting identical file.

I have been rolling out the MWBAM from the 1.6.0.2816 management console for the past month or so. From the "Client Push Install" tab I scan a range of our network to search for machines that may have been powered off and missed the install previously. When I re-scan a range that has been scanned and client pushed previously I always use the option to "Hide Installed Clients" and it has worked as expected until a week or so ago. Now my network scans show clients that I know have the client installed (confirmed on the Client tab) as not having the client installed. I'm looking for any help in resolving this. I am 700+ installs in with several hundred more to go and find it terribly inefficient to cross reference each IP address individually. Thank you, gkidd