How to track the user account logged in when the infection happened?

Hello,

first an emendation and an amendment .

A detection is not necessarily an infection. Infection can refer to an item or a computer, a trojan for example is not infected though. The term should be used with caution. 

You can't see who was logged on - Sophos does not keep track of logins. What you can see is the user context under which the file is accessed. For scheduled scans you'll see SYSTEM regardless of the logged on user.

You can see the user when you view the computer details (double-click the computer name, or select/right-click, or select/Actions menu).

Christian

hmmm.....a trojan, to my understanding, is a malware....thus, if a malware gets to be downloaded into your system, it's already considered an infection.....

Agreed - there's a subtle distinction between infection and infected in the meaning of broken out disease. Indeed Sophos calls their tool Sophos Source of Infection Tool. Still I'm reluctant to completely withdraw my statement - having dealt with, err, successful infections with yet unknown malware. Maybe someone can come up with distinctive terms :smileyhappy:

Anyway - did you find the information you were looking for?

Christian