Linux/DDoS-BH

Hey PaulsD

Sorry you're having trouble getting rid of this threat. Just curious, is this affecting your Mac, or Linux OS? 

I only ask because I'll send you over to our linux board if you're not experiencing this issue on OSX.

If, for some reason, this threat has managed to find it's way onto your Mac, I would refer you this article. It gives a really detailed overview of all the options you have for removing manually removing threats in OSX. 

Hi, thank you for answer. As i said in my message OSX 10.10.4. I will read the provided article now !

.... oh but i am not that much of a mor....... concerning your solution of virus removal ........

i DID that 7 or 8 times this week, AND also MANUAL file clean from /bin folder 4 times, but this virus keeps comming BACK EVERY DAY!, and that was my actual question :)!

Why does it come back if SOPHOS removes all virus files .

Whoops, sorry, I don't know how I missed that. I blame Monday morning :catembarrassed:

I think there's a good chance the threat you're experiencing is being downloaded as a mail attachment - that means it might be stored on your mail server. Although, you said it's stored on the /bin folder, which doesn't sound like the mail store. 

Just curious, can you post a copy the scan log? You can find that if you click on the Sophos shield icon, click "scans" and then click the little gear icon you'll find "open scan log." If you don't want to post it here, you can email me serra@sophos.com and i'll take a look.

could not post log. sent by mail

Hey, I was actually hoping you could send me the scan log. The one you sent was just the Sophos Anti-virus.log. 

To get the scan log:

• Click the Sophos shield icon and select 'Open Scans..."
• Click the small 'gear' icon at the lower left
• Click View Scan Log

This just gives a more detailed report of what's going on in the scan itself. 

Thanks!

scan log button is grey and inactive ?.....

Now the log in wheel is active, but shows the same content from /Library/log folder. Also there is a warning about infected files in log file, but this warning does NOT come up after scan !!! and i would not havew any idea avout this threat , if i did not look into log file ..... ????

• The files /Volumes/HD/LearntoCode/... are corrupted, not infected. They also showed up in the SAV log you emailed me yesterday. 
• I see you have a few custom scans set up. Which is the one that detects the Linux/DDoS-BH threat?

I ask this, because I'm still curious to see the full scan log for the scan that detects the threat you're having trouble with. Also I have to apologize I wasn't clear on how to get the scan logs. You should use the "gear" icon if you want to grab the scan logs for one of the custom scans. If you want to get the log for the "Scan this Mac" main scan, you can just alt-click the white space on the "Scan this Mac" menu and select "View Scan Log"

If you could get the log and copy the whole contents into your reply, or else send it to me via email, I would appreciate it.