UPDATE: 6PM (EST US). CA has release a new update file for CA Anti-Virus that corrects the issues that have occurred with the false positives. To update your system, just right mouse click on the shield that is in the systray (The icon next to the time example below), and then left click on update product. This will get you the updated files……
It is also recommended that you still verify that no files listed with the W32/Alalum infection are in quarantine. For a how to, just follow the 7 steps below from the original post.
*********************************************
On Saturday 7/4 reports started that McAfee Anti-virus was breaking pc’s because of an Anti-Virus update that was quarantining Windows System files as viruses ( http://techgeekandmore.wordpress.com/2009/07/04/alert-if-your-a-mcafee-anti-virus-user-do-not-update-your-av-until-you-see-this/ (http://techgeekandmore NULL.wordpress NULL.com/2009/07/04/alert-if-your-a-mcafee-anti-virus-user-do-not-update-your-av-until-you-see-this/) ).
Well it seems that someone else wasn’t paying attention. As of this morning I have received numerous reports from clients reporting that their CA Antivirus is showing Virus alerts for the W32/alalum virus and the files that were being reported appeared to be Windows systems files. CA was quarantining those files as well. When this 1st started I assumed it was an isolated issue but with the client messages concerning this coming in more and more this morning, this definitely seems to be a wide spread issue.
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/07/cavirusnotice NULL.jpg)
The issue appears to have been caused by an update the was released within the past 12 hours as CA Anti-Virus is set up to check for updates every few hours if your have the auto update feature turned on.
The biggest concern is that when these files are quarantined, if you reboot, there is a good chance that your machine will not restart. I had 2 clients so far “brick” their pc’s because of the restart. This point is made very clear as the WFP (Windows File protection) comes up saying that “Files that are required to run windows properly have been replaced”…… So far all reports (at least) from the clients I deal with show that CA Anti-virus 2007 – 2009 are affected.
From the CA Forums ( http://homeofficeforum.ca.com/homeofficeforum/forumdisplay.php?f=12 (http://homeofficeforum NULL.ca NULL.com/homeofficeforum/forumdisplay NULL.php?f=12) http://homeofficeforum.ca.com/homeofficeforum/showthread.php?t=4837 (http://homeofficeforum NULL.ca NULL.com/homeofficeforum/showthread NULL.php?t=4837) ) you will see many others also reporting the same issue.
Here are the instructions that I am passing on to my clients as this time.
1) Open CA Anti-virus by double clicking the shield looking icon in the systray (That is in the lower right corner by the clock)
2) The Security Overview window will open (Example shown here). Under the CA Anti-Virus you will see “Open advanced settings”. Click that link. 
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/07/caoverview NULL.jpg)
3) Once you are there you will see the main overview window. From here click on the left side where it says Quarantine.
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/07/camainpage NULL.jpg)
4) You will then see the list of files that are quarantined. Look for any file marked infected with W32/amalum (there is an additional part to the name after amalum but will be different on most pc’s). Highlight all items that are showing infected with amalum and then click on restore. NOTE***That if you have another file in quarantine that shows something other than amalum as the Infection then that is probably an actual virus infection (I will post info in a little while on clearing actual viruses). Once the files are restored you can close the CA windows
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/07/quarantinelist NULL.jpg)
4A) You will be prompted to say do you want to restore. Click on ok for each message
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/07/restoringca NULL.jpg)
5) At this point with no files in quarantine you should be able to hit cancel on the WFP. 
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/07/wfp NULL.jpg)
6) You will be prompted for keeping changed files click yes to this message. 
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/07/wfp2 NULL.jpg)
7) At this point restart PC.
CA appears to have acknowledged the issue and is supposed to be releasing an updated definitions files shortly. I will update again once I find out more.
(http://www
