Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 17 replies
  • Subscribers 6 subscribers
  • Views 48369 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Threat (Troj/Invo-Zip) comes back after manually deleting it from Time Machine backup. What now!?

Koamuseal

I've been having an issue with this detected threat:

threat.png

Every time I open the Quarantine Manager I see this threat in the list, but after a few seconds it disappears by itself before I have the chance to do anything about it.

I suspect the reason is that it has only been existing in my Time Machine backup, so I followed the steps from a thread in this forum about how to manually remove threats from TM backups.


In my case I have found out that the location for my threat seems to be in my mail 'Junk folder'. Through the Sophos Anti-Virus.log I found the pathway to where this threat is to be found:

(please note that I've replaced my e-mail account information with XXXXXXX)

V2/POP-XXXXXXX@XXXXXXXX.XX@mail.XXXXXXXX.XX/Junk.mbox/12A0ABC9-74E3-4CAB-ADBD-31C5B00D9360/Data/3/Attachments/3612/2/invoice.zip

I used Finder to locate the exact place for this threat, entered TM and removed it from all TM backups.


I then believed that the issue was solved, until the threat started to pop up again a couple of days later.

What do do now? I would really appreciate some help with this so I can get rid of this nasty thing once and for all.

:1014693


This thread was automatically locked due to age.
Parents
  • 0

    Okay, just noticed that the previous screenshot is too small to read and can't be enlarged except by me so here it is again, full sized. I had a go at following the video above but, since all the viruses appear to be located on my external HD, it wasn't as simple as the guy who posted the video made it look. Managed to locate the second one down on my external drive by following the path indicated by the log. It led me to a Pkg installer which, when I tried to delete it said I couldn't because it was backed up in Time Machine. Found it in Time Machine and deleted it only to see it return shortly after. As for the others, I would get so far down the path indicated in the log and then I'd hit a brick wall - it would lead me to the folder in my name within the users folder and then instruct me to follow 'containers/library'. At this point the trail disappears - there is no containers/library sub-folder. 

    Another confusion is that the path name for some of the viruses indicates an infection date in 2012 but when I go into the scan log to try and track it down there is nothing listed before 2013. I may just be thick but is there any way I can rid my Mac of these things before I eventually lose patience and throw it out of my upstairs window. Have these viruses become so sophisticated since the days when I used Norton that they can no longer be deleted by AV software? If anyone can help me out with an idiot-proof solution I'll be eternally grateful. Thanks in anticipation.

    Screen Shot 2014-07-29 at 21.03.04.png

    :1018559
Reply
  • 0

    Okay, just noticed that the previous screenshot is too small to read and can't be enlarged except by me so here it is again, full sized. I had a go at following the video above but, since all the viruses appear to be located on my external HD, it wasn't as simple as the guy who posted the video made it look. Managed to locate the second one down on my external drive by following the path indicated by the log. It led me to a Pkg installer which, when I tried to delete it said I couldn't because it was backed up in Time Machine. Found it in Time Machine and deleted it only to see it return shortly after. As for the others, I would get so far down the path indicated in the log and then I'd hit a brick wall - it would lead me to the folder in my name within the users folder and then instruct me to follow 'containers/library'. At this point the trail disappears - there is no containers/library sub-folder. 

    Another confusion is that the path name for some of the viruses indicates an infection date in 2012 but when I go into the scan log to try and track it down there is nothing listed before 2013. I may just be thick but is there any way I can rid my Mac of these things before I eventually lose patience and throw it out of my upstairs window. Have these viruses become so sophisticated since the days when I used Norton that they can no longer be deleted by AV software? If anyone can help me out with an idiot-proof solution I'll be eternally grateful. Thanks in anticipation.

    Screen Shot 2014-07-29 at 21.03.04.png

    :1018559
Children
No Data
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?