Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 16 replies
  • Subscribers 9 subscribers
  • Views 56291 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Threat with no filename/path, can't be removed. So what do I do?

clemactica

I occassionally get entries like this in my log:

com.sophos.intercheck: 2013-09-20 13:17:37 -0400 Threat: 'Mal/DrodZp-A' detected in
com.sophos.intercheck: Access to the file denied
com.sophos.intercheck:

There is no filename/path ("detected in" is all the log says -- eol) so I can't view in finder and attempts to remove hang/fail as would be expected. If I remove from the quarantine list, it'll just show up again later.

I have Time Machine/Time Capsule and I suspect it's something in a backup file on that volume but that's just my wild guess -- it is weird that Sophos finds it, doesn't/can't indicate the location, offers removal as an option, but is unable to remove it.

  1. Anyone have any insight into what this is (the "no file/path" aspect of the result, not the trojan itself)?
  2. Recommended course of action?

I've searched a bunch on this forum and haven't seen a definitive explanation for the null filename/path.

Thanks!

:1013519


This thread was automatically locked due to age.
Parents
  • 0

    Sounds weird.  It's the real time scanner detecting this.  If there is no path logged I would assume the scanner can't tell where the file is, or the file isn't on disk, or the disk it is on (or folder it is in) is causing a problem for the scanner (just throwing out ideas).

    What does an on demand scan show?  You may want to run a scan, but exclude the /Volumes/<Time Machine folder> path to speed it up - at least on the first run.

    Maybe then you can examine the on demand scan log (in Console) and see if the same thing is detected.

    :1013541
Reply
  • 0

    Sounds weird.  It's the real time scanner detecting this.  If there is no path logged I would assume the scanner can't tell where the file is, or the file isn't on disk, or the disk it is on (or folder it is in) is causing a problem for the scanner (just throwing out ideas).

    What does an on demand scan show?  You may want to run a scan, but exclude the /Volumes/<Time Machine folder> path to speed it up - at least on the first run.

    Maybe then you can examine the on demand scan log (in Console) and see if the same thing is detected.

    :1013541
Children
No Data
Unfiltered HTML