Troj/DocDrop-TJ

Question

Hi Guys, 
 I&acute;m using Sophos anti virus Home edition 9.6.1. 
 For the last couple of months, I get a "Threat detected by Sophos" message for every scan I make. 
 It reads: `virus/spywarre` Troj/docDrop-TJ has been detected and moved to quarantine. 
 I then open the quarantine manager, and can see several thousand (!) locations. 
 The pathname is almost the same for all of them: /user/mortenryberg/desktop/sophos/scan_003_6309024125.doc_1_1_4 
 The next one reads: /user/mortenryberg/desktop/sophos/scan_003_6309024125.doc_1_1_4_1 and so on and on 
 I then manually delete all the files in: /user/mortenryberg/desktop/sophos/ 
 I empty my Thrash bin afterwards. 
 Then in my next scan, the same happens..... 
 Can any one tell me whats going on, since I can't get ride of the malware? Where can I find the path to the original source of the malware, so I can delete it?

Morten Ryberg · Answer

com.sophos.oas: Sophos Anti-Virus com.sophos.oas: Product Version: 9.6.1 com.sophos.oas: Engine Version: 3.68.0 com.sophos.oas: Threat Data Version 5.41, 27 June 2017 com.sophos.oas: Includes detection for 13607390 threats com.sophos.oas: Copyright (c) 1989-2016 Sophos Ltd, www.sophos.com com.sophos.oas: com.sophos.oas: Using IDE files: com.sophos.oas: age-awlw.ide age-awmh.ide age-awmi.ide age-awmr.ide age-awpx.ide age-awpz.ide age-awqx.ide age-awrs.ide age-awsn.ide com.sophos.oas: andro-sv.ide auto-cah.ide auto-cal.ide auto-cav.ide bank-gtr.ide bank-gtv.ide bank-gtw.ide banl-cqt.ide bckd-ruq.ide com.sophos.oas: betab-bb.ide betab-bc.ide betab-be.ide betab-bf.ide blada-eo.ide blada-ey.ide blada-fa.ide cerb-amv.ide cerb-anb.ide com.sophos.oas: cerb-ani.ide chisb-rq.ide coinmi-t.ide darkc-fn.ide decep-ab.ide docd-jdz.ide docd-jei.ide docd-jej.ide docd-jfm.ide com.sophos.oas: docd-jge.ide docd-jhl.ide docd-jho.ide docd-jjh.ide docd-jjl.ide docd-jlm.ide docd-jly.ide docd-jmc.ide docd-jmz.ide com.sophos.oas: docdr-ae.ide docdr-wv.ide docdr-wy.ide docdr-xo.ide docdr-yd.ide docdr-zl.ide docdr-zr.ide dofoi-fr.ide dride-yd.ide com.sophos.oas: dride-ye.ide dride-yo.ide dride-ys.ide dwnl-tmw.ide equgrp-h.ide fare-dcl.ide fare-dcx.ide fare-ddr.ide fare-ddw.ide com.sophos.oas: fare-deu.ide fare-dex.ide fare-dfn.ide fare-dgg.ide fare-dgn.ide fare-dgy.ide fare-dhr.ide fare-dhz.ide fare-dia.ide com.sophos.oas: fare-dic.ide fare-did.ide fare-dif.ide fare-diu.ide gepys-s.ide gozi-ib.ide gozi-ig.ide gozi-ii.ide gozi-ij.ide com.sophos.oas: hawke-pa.ide hawke-pc.ide hawke-pe.ide htadl-ab.ide html-bz.ide htmld-ac.ide htmld-dt.ide htmldl-j.ide htmldr-b.ide com.sophos.oas: inje-cpv.ide inje-cqk.ide injec-si.ide jsdld-xc.ide konni-c.ide kovte-hh.ide lethi-br.ide lethi-bs.ide lethi-bt.ide com.sophos.oas: limit-ps.ide locky-xc.ide mdro-hxa.ide mdro-hxg.ide mdro-hxk.ide mdro-hxn.ide mdro-hyi.ide mdro-hyk.ide mdro-hyr.ide com.sophos.oas: miner-ce.ide miner-cp.ide miner-cr.ide miner-cu.ide miure-fc.ide msil-jvv.ide msil-jwc.ide msil-jwd.ide msil-jwe.ide com.sophos.oas: msil-jwt.ide msil-jxf.ide msil-jyh.ide msil-jzo.ide msil-kar.ide msil-kas.ide msil-kat.ide msil-kau.ide msil-kax.ide com.sophos.oas: msili-ob.ide msilkl-c.ide nanoc-ql.ide nanoc-qr.ide netwi-lt.ide netwi-lu.ide netwi-lx.ide netwi-ly.ide neutri-b.ide com.sophos.oas: nymai-eo.ide nymai-es.ide nymai-fd.ide nymai-fo.ide nymai-ft.ide nymai-gb.ide nymai-gf.ide pdfdw-an.ide pdfdw-aq.ide com.sophos.oas: pdfdwn-f.ide pdfu-ble.ide pdfu-bmv.ide pdfu-bmz.ide pdfu-bph.ide pdfu-bqu.ide pdfu-bri.ide pdfu-brm.ide pdfu-bto.ide com.sophos.oas: pdfu-btw.ide pdfu-buw.ide pdfu-bvi.ide pdfu-bvm.ide pdfu-bxi.ide pdfu-bxj.ide pdfu-bxo.ide pdfu-byp.ide pdfu-bzg.ide com.sophos.oas: petya-bh.ide petya-bi.ide petya-bk.ide petya-bl.ide petya-bn.ide phis-ajw.ide phis-alc.ide phis-ald.ide phis-ale.ide com.sophos.oas: phis-amo.ide phis-amr.ide phis-ams.ide phis-anv.ide phis-ape.ide phis-apg.ide phis-aph.ide phis-apk.ide phis-apm.ide com.sophos.oas: phis-apx.ide phis-apz.ide ps-d.ide pws-cja.ide qakbo-cd.ide qbot-da.ide qbot-dm.ide ramni-fi.ide rans-enl.ide com.sophos.oas: rans-enn.ide rans-enu.ide rans-eob.ide rans-eoe.ide rans-eof.ide rans-eom.ide rans-eot.ide rans-eou.ide rans-eov.ide com.sophos.oas: rans-eow.ide rans-epb.ide rans-epl.ide rat-j.ide recam-f.ide recam-i.ide recam-l.ide remcos-m.ide shiot-cb.ide com.sophos.oas: shiot-cc.ide shiot-ce.ide spora-an.ide talmad-c.ide trickb-q.ide ursni-bb.ide vb-jnh.ide vbs-op.ide vdl.dat com.sophos.oas: vortex-c.ide waucho-m.ide wont-aam.ide wont-aan.ide wont-aar.ide xtbl-ag.ide xtbl-ah.ide zbot-lsj.ide zbot-lsv.ide com.sophos.oas: com.sophos.oas: com.sophos.oas: com.sophos.oas: Started On-access protection within ScanD at 14:12 on 15 July 2017 com.sophos.oas: com.sophos.oas: com.sophos.oas: 2017-07-15 14:17:25 +0200 Threat: 'Troj/DocDrop-TJ' detected in '/Users/mortenryberg/Desktop/Sophos/Scan_003_6309024125.doc_5_3' com.sophos.oas: Access to the file denied com.sophos.oas: com.sophos.oas: 2017-07-15 14:17:25 +0200 Threat: 'Troj/DocDrop-TJ' detected in '/Users/mortenryberg/Desktop/Sophos/Scan_003_6309024125.doc_5_4' com.sophos.oas: Access to the file denied com.sophos.oas: com.sophos.oas: 2017-07-15 14:17:25 +0200 Threat: 'Troj/DocDrop-TJ' detected in '/Users/mortenryberg/Desktop/Sophos/Scan_003_6309024125.doc_5_5' com.sophos.oas: Access to the file denied com.sophos.oas: com.sophos.oas: 2017-07-15 14:17:25 +0200 Threat: 'Troj/DocDrop-TJ' detected in '/Users/mortenryberg/Desktop/Sophos/Scan_003_6309024125.doc_6_1' com.sophos.oas: Access to the file denied com.sophos.oas: com.sophos.oas: 2017-07-15 14:17:26 +0200 Threat: 'Troj/DocDrop-TJ' detected in '/Users/mortenryberg/Desktop/Sophos/Scan_003_6309024125.doc_6_1_1' com.sophos.oas: Access to the file denied 
 
 There are no lines after the above. It ends with the above, but as written before after several thousands lines... 
 The Sophos folder on my desktop is empty when the scan starts.