Mal/Generic-S in Temp folder

Hi Andreas Sandner

May I know if you can still access the file path? Have you tried deleting the file manually? Also, in the central dashboard, under Threat Analysis centre you should be able to view more details about the detection and the root cause. Make sure all your systems are patched and protected.  

Hello Shweta,

the file path is gone. I deleted the folder, although it was already empty when I checked. There is actually a second detection now, this time. The first detection (Mal/Generic-S) comes from node.exe (primary reason "Nodejs"), but that has not occured since Friday.

Now I have a second one, C2/Generic-A, apparently Firefox is trying to connect to "de . withtls . net" which is classed as a high risk site by Sophos, containing exactly this malware. Apparently there is something wrong with this device, even though the full scan doesn't yield any results.

UPDATE: I found an empty Firefox extension (no name, no text) that could not be removed. I cleaned Firefox, this removed the extension. However, there's another detection now "Generic PUA CK". This seems to be "Outbrowse".

I reinstalled the PC.

Hi Andreas Sandner

If a C2 detection alert has been triggered this means that the Sophos Endpoint Security and Control product has detected communication with a suspect Command and Control site. For C2/Generic-A or C2/Generic-C, please refer How to investigate C2/Generic-C Detection

Hi Andreas Sandner

If a C2 detection alert has been triggered this means that the Sophos Endpoint Security and Control product has detected communication with a suspect Command and Control site. For C2/Generic-A or C2/Generic-C, please refer How to investigate C2/Generic-C Detection