This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

File returns even after deleting it

Today I received an email from Sophos Enterprise Console saying:

Virus/spyware 'Troj/DocDl-ETL' has been detected in "C:\$Recycle.Bin\S-1-5-21-507921405-362288127-725345543-29192\$RTM31FA.msg\S". Cleanup unavailable.

I have logged into that computer user the user's creds and it deletes fine without an issue but then it will reappear the next scan or the next day.

Anyone have any idea why this file keeps popping back up even though it's been deleted multiple times?

Best,

Brad

This thread was automatically locked due to age.

0 Bohdan.S over 7 years ago

My guess would be, since its a msg file the original file is still in the email mailbox. Try scanning the users mailbox.

Regards,
Bohdan
Cancel
Vote Up 0 Vote Down

Cancel
0 Brad Krivelow over 7 years ago in reply to Bohdan.S

Did a scan and nothing pops up. When we go to that location the file is not there but still we are getting alerted.
Cancel
Vote Up 0 Vote Down

Cancel
0 Bohdan.S over 7 years ago in reply to Brad Krivelow

Try turining on Hidden Files and System Files in explorer, then see if it is still there.

Also could try running the stand alone tool ( https://www.sophos.com/en-us/products/free-tools/virus-removal-tool.aspx )

Also try disabling system restore, as it might be using that to restore iteslf.

Regards,
Bohdan
Cancel
Vote Up 0 Vote Down

Cancel