This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

A lot of WMV files deleted since last weeks for unknow reason

Hello,

since last week, for unknown reason our Sophos Endpoint delete all WMV files on computers.

This is the event : 
Malware detected: 'W32/GetCodec-A' at 'XXX\Intro discours.wmv' 

Any idea why it's happen now?? I already created a ticket to sophos but it's  taking a long time and ask me some files for investigate but it seems all wmv files..

Thank you.



This thread was automatically locked due to age.
Parents
  • Hi, 

    Thanks for reaching out to us. 

    As an immediate workaround, if you believe the files are clean/safe, it’s possible to create a file pattern exclusion so that the .wmv files aren’t cleaned up. I recommend adding the exclusion with the file location included so that you’re not white-listing .wmv files located anywhere. 

    e.g.: C:\Users\<User>\Downloads\*.wmv

    I recommend sending in one of the detected files using the following link so our team can make adjustments if needed. 
    - Sample Submission

    It’s possible to restore a file by navigating through Sophos Central to the device page in question to select the "Details" button on the detection event. If you don’t wish to restore the file, I recommend working with our support team to obtain the file from the Safestore. This is located at the following path. 

    - C:\ProgramData\Sophos\Safestore\

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
  • Hello, yeserday it's a lot of MP3 files was deleted and the computer was marked as Outbreak event ! IT's never happen before. 

    I already send a WMV files detected as virus yesterday to sample submission. Have i now to send an usual mp3 files for investigation? Have i to create a pattern files for usual WMV and MP3 files ? I don't understand why today all files are deleted . Why now? Why have i to do exclusion? 

    FOr MP3 the message is Mal/ASFDldr-A'

  • If you are seeing unique detections for some of the files, I recommend sending these in as well for further analysis. As the detections have come up just recently, I suspect an update occurred to the detection engine which caused the files to get picked up. 

    The specific detection "Mal/ASFDldr-A" corresponds to the following behaviour.
    The malicious files use Microsoft Media Player's scripting capability to open a web browser to an infected site instead of playing the video

    In this situation, I do not recommend creating exclusions, you will need to send in a copy of the files stored in the "Safestore" directory. 

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
Reply
  • If you are seeing unique detections for some of the files, I recommend sending these in as well for further analysis. As the detections have come up just recently, I suspect an update occurred to the detection engine which caused the files to get picked up. 

    The specific detection "Mal/ASFDldr-A" corresponds to the following behaviour.
    The malicious files use Microsoft Media Player's scripting capability to open a web browser to an infected site instead of playing the video

    In this situation, I do not recommend creating exclusions, you will need to send in a copy of the files stored in the "Safestore" directory. 

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
Children