This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

\\.\Globalroot infection

Sophos A.V. is reporting a Trojan at \\. \GLOBALROOT\Device\HarddiskVolumeShadowCopy7\Program Files\Sophos\PureMessageT\empxxxxx.
As far as I am aware Shadow Copy has never been enabled on this machine and if I do a "vssadmin list shadows" the response is that no shadows exist.
Anyone know how I can access this file so that I can delete the infection?

This thread was automatically locked due to age.

Parents

0 RRR over 14 years ago

This is on the PureMessage box, so depending of what policy you set for this server (block, delete, move) it might have already been deleted by Sophos.
:2188
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 RRR over 14 years ago

This is on the PureMessage box, so depending of what policy you set for this server (block, delete, move) it might have already been deleted by Sophos.
:2188
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data