Can't remove trojan from server

Hi BenjaminR,

Can you shed some more light on the reported detection? What is the file that is being detected, action other similar detections post this entry?

Thanks for the reply. The weird thing with sopohos central is that I cant see what file. I only see the detection and I have no options to fix it. This what I see in Sophos central:

And the previous screenshot is the only thing I can see on the client software installed on our server. I cant see no quarantine, see what file is affected, etc. At times I'm really confused about the whole Sophos central solution.. 

Hello BenjaminR,

you say you have repeated detections of Troj/MeterMem-A? According to the analysis this is the meterpreter module of the Metasploit Framework. "Normally" it's loaded into memory by a successful exploit. It shouldn't recur after a reboot unless there's some persistent threat.
I'd suggest you contact Support directly.

Christian

Hi Christian,

Thanks for the reply. No, luckily it;s not repeated detections. It's a very old detection that I just cant get rid of. It was cleaned already I suspect, but somehow there is no option to clear it. I will contact support I guess.

Thanks!

Benjamin

Hello Benjamin,

a very old detection
in this case you probably don't need to contact support. Central Admin doesn't let you mark the Alert as resolved?

Christian

No, because it doesn't show in the alerts tab (see screenshot below).

Is there some way to get into the quarantine folder to see if there is anything?

Hello Benjamin,

and it's not on the Alerts list you access from the dashboard, is it?

the quarantine folder
there isn't such a folder AFAIK and anyway  how should a threat detected in memory be stored? The quarantine is the list of detected and yet unresolved threats.

I'm not using Central, I understand that the local GUI has been "reduced" - is the Alert listed under Events? While the Help says actions you can take are the same as those available in the Sophos Central Admin console I'm not sure whether this includes marking it as resolved (naturally if the alert is shown in the list at all).

Christian

I've been in contact with Sophos support. They have deleted the db file which stores notifications. It didnt refresh, so that was the problem. The threat was long gone. ;-)

Thanks for the help!