Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 17 replies
  • Subscribers 6 subscribers
  • Views 48365 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Threat (Troj/Invo-Zip) comes back after manually deleting it from Time Machine backup. What now!?

Koamuseal

I've been having an issue with this detected threat:

threat.png

Every time I open the Quarantine Manager I see this threat in the list, but after a few seconds it disappears by itself before I have the chance to do anything about it.

I suspect the reason is that it has only been existing in my Time Machine backup, so I followed the steps from a thread in this forum about how to manually remove threats from TM backups.


In my case I have found out that the location for my threat seems to be in my mail 'Junk folder'. Through the Sophos Anti-Virus.log I found the pathway to where this threat is to be found:

(please note that I've replaced my e-mail account information with XXXXXXX)

V2/POP-XXXXXXX@XXXXXXXX.XX@mail.XXXXXXXX.XX/Junk.mbox/12A0ABC9-74E3-4CAB-ADBD-31C5B00D9360/Data/3/Attachments/3612/2/invoice.zip

I used Finder to locate the exact place for this threat, entered TM and removed it from all TM backups.


I then believed that the issue was solved, until the threat started to pop up again a couple of days later.

What do do now? I would really appreciate some help with this so I can get rid of this nasty thing once and for all.

:1014693


This thread was automatically locked due to age.
Parents
  • 0

    Hi, ruckus.

    Thanks for your continued support (and patience). 

    To answer your question, I'm relatively comfortable using Terminal if I'm shown what to do. I know nothing about code, however, so wouldn't even know where to begin if I had to tackle it unaided. I'm heartened by the fact that with the viruses being in my back up files they pose no real threat. However, the Troj/Invo-Zip virus I cleared from the list in frustration earlier was originally unearthed on my Mac before I reconnected my external drive to it. If the best I can manage is get rid of it of the Mac itself I will consider a small victory.

    I thought it would be easier for both of us to email the scan log to you. The original file name was too long and so I had to rename it Iomega EDD.log.zip. I'm just going to email it over to you right now. I've been at this all night now though so I'm going to call it a night and get some sleep so it'll be some time tomorrow before I can get back to you if there's anything you need from me.

    Thanks once again for all your efforts to help me. They are very much appreciated.

    :1018563
Reply
  • 0

    Hi, ruckus.

    Thanks for your continued support (and patience). 

    To answer your question, I'm relatively comfortable using Terminal if I'm shown what to do. I know nothing about code, however, so wouldn't even know where to begin if I had to tackle it unaided. I'm heartened by the fact that with the viruses being in my back up files they pose no real threat. However, the Troj/Invo-Zip virus I cleared from the list in frustration earlier was originally unearthed on my Mac before I reconnected my external drive to it. If the best I can manage is get rid of it of the Mac itself I will consider a small victory.

    I thought it would be easier for both of us to email the scan log to you. The original file name was too long and so I had to rename it Iomega EDD.log.zip. I'm just going to email it over to you right now. I've been at this all night now though so I'm going to call it a night and get some sleep so it'll be some time tomorrow before I can get back to you if there's anything you need from me.

    Thanks once again for all your efforts to help me. They are very much appreciated.

    :1018563
Children
No Data
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?