This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Virus/Spyware 'Troj/FarFli-CT' was not removed because of errors

Hello,

We have a number of machines that are running Windows 7, where they are flagging an error code a0250026, with a description Virus/spyware 'Troj/FarFli-CT' was not removed because of errors. This is saying that there is an issue detected in C:\Windows\System32\winlogon.exe, there was a KB article sent out September 2016, with a workaround. I would have thought that in two years Sophos would have resolved this in later releases.

Is there any recent articles on this anywhere? Also is there a better fix rather than just to ignore the issue, I have done this on a machine to test and it just comes back.

Thanks in advance.

Will Janes.

This thread was automatically locked due to age.

0 QC over 6 years ago

Hello Will Janes,

the detections indicate C:\Windows\System32\winlogon.exe as infected? Any issues woth logon on the machines?
If it's indeed again winlogon.exe please submit a sample.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Will Janes over 6 years ago in reply to QC

Hello QC,

Yes, looking on the machine itself in the endpoint agent, I am seeing two items in the quarantine manager.

One in C:\Windows\winsxs\Backup and the other C:\Windows\System32\winlogon.exe.

Looking at the file in question, these are both relating to the winlogon.exe

Thanks,

Will Janes.
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to Will Janes

Hello Will Janes,

shouldn't be again a fault in one of [their] endpoint protection verification systems. Anyway, Labs have to take a look at it, so please submit the file(s). Usually doesn't take more than a few hours to get a response and if necessary an update.

Christian
Cancel
Vote Up 0 Vote Down

Cancel