On-Premise Endpoint

Sophos Enterprise Console powershell virus

On-Premise Endpoint requires membership for participation - click to join

Thread Info

State Not Answered
Locked Locked
Replies 21 replies
Subscribers 6 subscribers
Views 1368970 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

powershell virus

ChuckYu over 6 years ago

Dear All,

Virus detect by Symantec that use powershell and spend almost 100% CPU. Nothing detect by Sophos.

I am stop process of powershell and it will back again later.

Anything I can do to clean this virus?

Thanks a lot!

Chuck

This thread was automatically locked due to age.

Parents

0 jak over 6 years ago

I would initially run Process Explorer - https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer
This will give you the process that launched Powershell.exe from the process tree.

As it comes back, I would also run Process Monitor - https://docs.microsoft.com/en-us/sysinternals/downloads/procmon . This will help track how it is being launched etc..

Regards

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 ChuckYu over 6 years ago in reply to jak

Hi Jak,

Thanks for your reply.

That is happened in our network, not one or some computers.

This is lot of computer need to run the application one by one.

Is sophos can do something make things simple?

Thanks a lot!

Chuck
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 ChuckYu over 6 years ago in reply to jak

Hi Jak,

Thanks for your reply.

That is happened in our network, not one or some computers.

This is lot of computer need to run the application one by one.

Is sophos can do something make things simple?

Thanks a lot!

Chuck
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data