Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 7 subscribers
  • Views 21618 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Troj/DocDI-NP

adrianb

I am repeatedly getting the following message:

'Virus/Spyware' Troj/DocDl-NP has been detected and listed in Quarantine Manager.

However, when I go to quarantine manager the message appears briefly and vanishes.  This happens once or twice a week.  If I follow the hyperlink to the virus name Sophos says nothing is found in the knowledge base.

Any ideas on how to solve this one?

:1021480


This thread was automatically locked due to age.
  • 0
    Do you have Time Machine connected? This behavior can occur when something is detected in a backup. Disconnect the volume for a bit and see if the issue comes back or not.

     - - - - - - - - - - - -

    Communities Moderator, SOPHOS
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • 0
    This is interesting I just joined to report an exact same issue - my file is Troj/DocDI-E.
    I have run the scanner earlier and found a number of doc & pdf &zip.pdf files that were reported. Ialso found Issues such as corrupted files and encrypted files in the log. I dealt with all of these by manually removing them. However this file keeps popping up. I have also removed the instances of reported virus/malware that were in the backups. Still it persists. I have the report coming up when the laptop is disconnected from the network and is working standalone.. I have updated all defs running sudo rm -rf /Library/Caches/com.sophos.sau/ ; /usr/bin/SophosUpdate and followed this with a full scan which reports a clean sweep. but still I have this popup but nothing there.
  • 0 in reply to StephenThornber

    Hey Stephen,

    In cases like this I recommend checking the scan log to see where the file is. 

    To Access the Scan Log

    - Click the Sophos menu bar Icon

    - Click on Open Scans... 

    - Alt-click the white space by "Scan this mac" and select View Scan Log...

    This will open the Scan Log in an application called Console. The scan log gives you detailed information about the most recent scans, such as start time, what was scanned, scan configuration, any threats that were detected, etc. You should also see any errors that may have been encounted by the scanner. 

     

    So take a look at the log, and see if you find any errors listed. Feel free to copy and paste any errors you see into your reply and I will take a look.

  • 0 in reply to serra
    Hello, I have gone through the log line by line and deleted ALL occurances of Corrupted or Encrypted and Malicious files from ALL locations, the NAS Box, the Apple storage and the local MAC Laptop.
    With the laptop not connected to any other device that is no LAN or WiFi connection the popup comes up on the screen. When you click Quarantine manager it is there a second or so and then dissapears. I have re run the Sophos Update (Connected to the WiFi obviously) and then disconnected WiFi and run a full scan - no issues or malicious code found and then a few minutes later there is my friendly pop up :)
    Go figure..... :)
Unfiltered HTML