Sophos is warning for a Trojan Horse that is no longer on my system

Question

Hi, 
 
 A couple of days ago, Sophos warned me of threats in my data. I was testing with an Outlook mailfile of one of my friends. The Outlook database originated on a Windows machine and I tried to restore it in my OSX Outlook App. That proces went OK, but the threat warning seemed valid. I told Sophos to clean up the threat and I also deleted the mailfile from my Mac. 
 
 The problem now is, that Sophos keeps on warning me for one of the threats, even though the file is no longer on my system&hellip; 
 I thought I may have missed something, but looking at the log seems to support my assumption that I did remove the file. 
 The warning is very persistent and pops up a few minutes after I close the Quarantine Manager. Instructing the Quarantine Manager to remove the file, does not work since the file is no longer there&hellip; 
 
 This is the warning from the log:

com.sophos.intercheck: 2015-10-22 21:43:48 +0200 Threat: 'Troj/JSDldr-BW' detected in 
 com.sophos.intercheck: Access to the file denied 
 com.sophos.intercheck: 
 com.sophos.intercheck: 2015-10-22 21:44:55 +0200 Threat: 'Troj/JSDldr-BW' detected in 
 com.sophos.intercheck: Access to the file denied 
 com.sophos.intercheck:

(the original message pointed to the directory where Outlook stores its content on Mac, but the current one has no directory reference....) 
 
 I am running OSX 10.11.1 (production version) 
 Sophos: Home Edition version 9.4.0 
 Threat detection engine: 3.61.0 Threat data: 5.20 
 
 I did a complete re-install of Sophos, but the issue remains.... 
 
 Hope anybody can help me out! 
 
 Jack

serra · Accepted Answer

Hey Jack, 
 
Thanks for stopping by, and sorry to hear you're having trouble. I'd recommend you take a look at the following KB article: 
 
 community.sophos.com/.../118117 
 
I know it's a pretty long article, but I think step 18 might be the answer to your problem - I'm guessing the file is being downloaded from your email server so that's why it keeps coming back. You need to figure out which email has the bad attachment, go to your inbox, and delete the offending file. 
 
Also, if you need to see where the file is located, you can check the scan log: 
 
- Click the Sophos menu bar Icon 
- Click on Open Scans... 
- Alt-click the white space by "Scan this mac" and select View Scan Log... 
 
This will open the Scan Log in an application called Console. The scan log gives you detailed information about the most recent scans, such as start time, what was scanned, scan configuration, any threats that were detected, etc. You should also see any errors that may have been encountered by the scanner. 
 
Hope that helps, but let me know if you have any other trouble. 
 
Cheers,