Sophos Can't Manually Remove OSX/iWorkS-A Threat. How Can I Get Rid Of It?

For further clarification I did the clean up procedure in the following link. Specifically step 12 where it sets up a custom scan for the mentioned threat. 

http://www.sophos.com/en-us/support/knowledgebase/118117.aspx

Hi MLN1963,

The guys in SophosLabs believe the product should automatically clean up that threat, so its odd that its not doing that for you. Definitely interested to learn more, if you are willing to share samples or at least some info about the paths of the files being reported in the Quarantine Manager.

When you created your custom scan, did you select "When a threat is found: Delete threat" in the options panel? That is step 15, just confirming that your scan was set up like that.

Are the files to be removed located on a removable drive or on a Time Machine backup? That sometimes prevents us from taking action.

Looking forward to your response.

Bob

The file is on the "C" drive
I did set it to delete the file.

I don't know why the image links won't work? Hopefully the direct links will work and help you.

 http://i1346.photobucket.com/albums/p700/mln1963/ScreenShot2013-08-13at85454PM_zps463513b9.jpg

http://i1346.photobucket.com/albums/p700/mln1963/ScreenShot2013-08-13at95511PM_zps6857bc9d.jpg

http://i1346.photobucket.com/albums/p700/mln1963/ScreenShot2013-08-13at95539PM_zps817cbf09.jpg

Thanks for taking the time to figure this out.

Mark

Hi Mark,

Thanks for the screen shot, the first one was particularly useful as it explains what is going on.

The scanner picked up the file inside "Adobe CS4 Master Collection.toast" which is actually a disk image (I believe its actually using the same ISO format as CDs or DVDs). The scanner only can read that file structure but cannot "edit" (delete) contents from it. We don't automatically delete the whole disk image because there might be other useful things contained inside.

You have two choices: (1) just delete the whole archive (Adobe CS4 Master Collection.toast); or (2) decode the ISO to disk, let the scanner clean up the offending bits, then recreate the archive.

You should restore the "Adobe CS4 Master Collection.toast" from a legitimate Adobe source and rescan. If it still gives the same detection then I'll need more details about how we can replicate your results (as it would suggest our detection is incorrectly firing on authentic Adobe software).

Hope that helps.

Bob

Deleting the whole archive isn't an issue as I hardly use those programs anyway. That said, can this file pose a threat if it is in disc image form and not expanded? I'm not sure how to do the steps you mentioned, decode to disc and then recreate the archive but could probably figure it out with Google. Sorry, I'm not real Mac savy.  

Thanks

Mark

---

MLN1963 wrote:

That said, can this file pose a threat if it is in disc image form and not expanded?

---

Nope, these files will not be harmful until someone expands the disk image and runs them.

That is good to know. If I was to try delete the file do I just select it and hit delete in finder or is there other steps since it is and image file?

---

MLN1963 wrote:

If I was to try delete the file do I just select it and hit delete in finder or is there other steps since it is and image file?

---

Nothing fancy required (it's a Mac!). Drag the archive to the "trash can" and select "Empty Trash" from the Finder menu (top left).

Thanks Bob!