Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 1 subscriber
  • Views 3327 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

\\.\Globalroot infection

Ianh

Sophos A.V. is reporting a Trojan at \\. \GLOBALROOT\Device\HarddiskVolumeShadowCopy7\Program Files\Sophos\PureMessageT\empxxxxx.
 As far as I am aware Shadow Copy has never been enabled on this machine and if I do a "vssadmin list shadows" the response is that no shadows exist.
Anyone know how I can access this file so that I can delete the infection?

:2168


This thread was automatically locked due to age.
Unfiltered HTML