Board Thread:Speculation House/@comment-14138255-20151213162620/@comment-26397825-20151222114045

They didn't actually see the terminal flash the queen symbol. When the terminal in the CCT flashed the queen symbol, no one was looking at or had clear vision of a computer screen. When Ironwood's scroll flashed, it was not a literal flash, but a stylistic choice to indicate to the viewers that something had happened.

So no, they don't know there is a virus. All they know is that someone broke into the CCT to do something, not that there is a virus. They probably ran a virus scan, which turned up nothing because I sincerely doubt Cinder would use a virus that could be tracked by a scanner just yet - you have to know about a program in order to be able to combat it after all - and left it at that, thinking that the Infiltrator probably wanted to use the CCT to make a phonecall or download some data or something.