Threat (Troj/Invo-Zip) comes back after manually deleting it from Time Machine backup. What now!?

Right, so, the logs show five threats detected in, what I see as six separate files.  The detection and locations are:

Since they are all in backups you're safe from them.  Options you could choose are:

• Clear the items from the list, exclude the backup drive from future scans, and ignore them being in there.  Over time the backups will be deleted as space is required on the drive and the older back ups will be purged.
• Keep scanning as you are doing but always ignore the ones that come up in the quarantine for the back up location and clear from list.
• As the files are inside a Time Machine, go into Time Machine, and hunt down and delete the files.

Several users have opted for option one as it speeds up the scan time - no point scanning something in a backup (that would be detected by the on-access scanner if it was ever restored).  Some perhaps select option two, or maybe fall into that one when they run a new scan and forget to exclude the drive.  Basically when there is problem cleaning up: dig into the log and when you see part of the path mention '....Backups.backupdb/...' stop right there, head back to the quarantine and clear those from the list - repeat as required.  If you configure a scan right and always use that the detections won't come back and you'll fall into option one.

However some decide to go with option three.  Since the files are inside a TM backup (a rather complex and encrypted file - hence why SAV can't delete from outside of the program) it's not recommended to do anything outside of Time Machine.  Therefore to follow option three I'd suggest:

1. Switch hidden files on first (http://openforum.sophos.com/t5/Mac-tools-help/How-to-show-all-hidden-files-in-Finder/td-p/18485)
2. Note the date and path of the detections (see your original logs as I redacted info. in the table above).
3. Enter Time Machine.  You will be able to see all files if you followed point one and hence won't be hindered by hidden files/folders.
4. Use the noted dates and paths to delete all copies of a particular threat (file) from inside Time Machine (there is a handy option to do this in TM).
5. Leave Time Machine.
6. For the post under point one above switch the hidden files filter back on so Finder is less cluttered for daily use.

Of course steps 3-5 are a bit vague so watch this video:

Hope that helps move you forward.  Post back if you need anything/say how you got on.

Right, so, the logs show five threats detected in, what I see as six separate files.  The detection and locations are:

Since they are all in backups you're safe from them.  Options you could choose are:

• Clear the items from the list, exclude the backup drive from future scans, and ignore them being in there.  Over time the backups will be deleted as space is required on the drive and the older back ups will be purged.
• Keep scanning as you are doing but always ignore the ones that come up in the quarantine for the back up location and clear from list.
• As the files are inside a Time Machine, go into Time Machine, and hunt down and delete the files.

Several users have opted for option one as it speeds up the scan time - no point scanning something in a backup (that would be detected by the on-access scanner if it was ever restored).  Some perhaps select option two, or maybe fall into that one when they run a new scan and forget to exclude the drive.  Basically when there is problem cleaning up: dig into the log and when you see part of the path mention '....Backups.backupdb/...' stop right there, head back to the quarantine and clear those from the list - repeat as required.  If you configure a scan right and always use that the detections won't come back and you'll fall into option one.

However some decide to go with option three.  Since the files are inside a TM backup (a rather complex and encrypted file - hence why SAV can't delete from outside of the program) it's not recommended to do anything outside of Time Machine.  Therefore to follow option three I'd suggest:

1. Switch hidden files on first (http://openforum.sophos.com/t5/Mac-tools-help/How-to-show-all-hidden-files-in-Finder/td-p/18485)
2. Note the date and path of the detections (see your original logs as I redacted info. in the table above).
3. Enter Time Machine.  You will be able to see all files if you followed point one and hence won't be hindered by hidden files/folders.
4. Use the noted dates and paths to delete all copies of a particular threat (file) from inside Time Machine (there is a handy option to do this in TM).
5. Leave Time Machine.
6. For the post under point one above switch the hidden files filter back on so Finder is less cluttered for daily use.

Of course steps 3-5 are a bit vague so watch this video:

Hope that helps move you forward.  Post back if you need anything/say how you got on.