Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 8 replies
  • Subscribers 1 subscriber
  • Views 6191 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

The attempt to delete the infected file "X" failed. The user does not have the rights...

JohnH

Hi all,

We are getting the following message more and more often:

The attempt to delete the infected file "X" failed.  The user does not have the rights to perform the action on the infected file

When I 'click -through' to the Sophos site it states that the Sophos Anti-Virus service should be run using an Administrator account.  When I checked, the service uses NT AUTHORITY\LocalService.  Is this the correct account or do we have an installation problem?

Thanks,

John

:384


This thread was automatically locked due to age.
Parents
  • 0

    John,

    The Sophos service should run as Local System - can you let me know which article states different?

    Depending on how you are trying to remove this malware item depends on what permissions are in effect - for example, the automatic options in the On Access scanner will run as Local System, but a user opening the GUI and triggering a scan will run with their own permissions.

    If you can see this alert in the "Cleanup" tab in Enterprise Console, clean it using that - this should have enough permissions - you can also try setting up a scheduled scan set to Cleanup or Delete, depending on the item.

    As you can see, a bit more information may help us get you more specific answers - feel free to elaborate if the above didn't help!

    :446
Reply
  • 0

    John,

    The Sophos service should run as Local System - can you let me know which article states different?

    Depending on how you are trying to remove this malware item depends on what permissions are in effect - for example, the automatic options in the On Access scanner will run as Local System, but a user opening the GUI and triggering a scan will run with their own permissions.

    If you can see this alert in the "Cleanup" tab in Enterprise Console, clean it using that - this should have enough permissions - you can also try setting up a scheduled scan set to Cleanup or Delete, depending on the item.

    As you can see, a bit more information may help us get you more specific answers - feel free to elaborate if the above didn't help!

    :446
Children
No Data
Unfiltered HTML