On-Premise Endpoint

Sophos Endpoint Software PUA's in Shadowcopy on Windows server 2008

On-Premise Endpoint requires membership for participation - click to join

Thread Info

State Not Answered
Locked Locked
Replies 6 replies
Subscribers 4 subscribers
Views 10489 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

PUA's in Shadowcopy on Windows server 2008

Paul McCherry over 7 years ago

I am getting hundreds of PUA's errors within Shadowcopy on a windows Server 2008 and trying to work out how to delete them.

I have tried disabling and removing shadowcopy on the affected drives but this has had no effect.

Any Ideas ?

This thread was automatically locked due to age.

Parents

0 jak over 7 years ago

What are the names of the PUAs? Could they be something you could just authorize?

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 Paul McCherry over 7 years ago in reply to jak

Mainly files that are infected with the following:-

Troj/Caphaw-AN

Troj/CeeInj-N

and files such as

Path: \\.\GLOBALROOT\Device\HarddiskVolumeShadowCopy6\Users Shared Folders\StephenT\AdwCleaner\Quarantine\C\Users\StephenT\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\DaemonProcess.exe.vir

What was detected: Generic PUA JL
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 7 years ago in reply to Paul McCherry

OK, so there is a mix of malware (Troj/Caphaw-AN, Troj/CeeInj-N) and non-specific Potentially Unwanted Applications (PUAs) in the form of "Generic PUA JL".

I'm guessing this didn't help: https://community.sophos.com/kb/en-us/114422 ?

I was think it you just had maybe things like pskill, psexec, PUAs you could just authorize them in policy.

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 jak over 7 years ago in reply to Paul McCherry

OK, so there is a mix of malware (Troj/Caphaw-AN, Troj/CeeInj-N) and non-specific Potentially Unwanted Applications (PUAs) in the form of "Generic PUA JL".

I'm guessing this didn't help: https://community.sophos.com/kb/en-us/114422 ?

I was think it you just had maybe things like pskill, psexec, PUAs you could just authorize them in policy.

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data