Can't remove trojan from server

Hello BenjaminR,

you say you have repeated detections of Troj/MeterMem-A? According to the analysis this is the meterpreter module of the Metasploit Framework. "Normally" it's loaded into memory by a successful exploit. It shouldn't recur after a reboot unless there's some persistent threat.
I'd suggest you contact Support directly.

Christian

Hi Christian,

Thanks for the reply. No, luckily it;s not repeated detections. It's a very old detection that I just cant get rid of. It was cleaned already I suspect, but somehow there is no option to clear it. I will contact support I guess.

Thanks!

Benjamin

Hello Benjamin,

a very old detection
in this case you probably don't need to contact support. Central Admin doesn't let you mark the Alert as resolved?

Christian

No, because it doesn't show in the alerts tab (see screenshot below).

Is there some way to get into the quarantine folder to see if there is anything?

Hello Benjamin,

and it's not on the Alerts list you access from the dashboard, is it?

the quarantine folder
there isn't such a folder AFAIK and anyway  how should a threat detected in memory be stored? The quarantine is the list of detected and yet unresolved threats.

I'm not using Central, I understand that the local GUI has been "reduced" - is the Alert listed under Events? While the Help says actions you can take are the same as those available in the Sophos Central Admin console I'm not sure whether this includes marking it as resolved (naturally if the alert is shown in the list at all).

Christian

Hello Benjamin,

and it's not on the Alerts list you access from the dashboard, is it?

the quarantine folder
there isn't such a folder AFAIK and anyway  how should a threat detected in memory be stored? The quarantine is the list of detected and yet unresolved threats.

I'm not using Central, I understand that the local GUI has been "reduced" - is the Alert listed under Events? While the Help says actions you can take are the same as those available in the Sophos Central Admin console I'm not sure whether this includes marking it as resolved (naturally if the alert is shown in the list at all).

Christian

I've been in contact with Sophos support. They have deleted the db file which stores notifications. It didnt refresh, so that was the problem. The threat was long gone. ;-)

Thanks for the help!