Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 2169 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

"Mal-sillyFDC-N" - Sophos does not clean it + problem with complete scanning

hasan

Hi there,

two issues:

1) Sophos has detected the "Mal-sillyFDC-N" worm and put it into Quarantine.

Following the instructions I selected the automatic "cleaning" tool/button.

Sophos started to do this cleaning operation, but it runs for more than 10 hours without reaching the end.

The software tells me that "Processing cleaning" (I have a German version: "Bereinigung läuft").

No error message appears and checking in the Windows Task-Manager Sophos is running fine.

I have attempted and relaunched this cleaning operation several times, but the same happened.

2) I wanted to do a complete scan of my computer, but Sophos gets always stuck at 2%, i.e. only after 1639 or 1642 files scanned. Also in this case I have tried the operation several time and let the scan running for more than 10 hours.

How can I tackle these issues? Any suggestions?

I have already contacted the online help, but no successful help received so-far.

Additional info:

Sophos 9.7 on a Windows XP professional (SP3)

2.53 GHz

3 GB Ram

Many thanks for your attention,

Andrea

:13749


This thread was automatically locked due to age.
  • 0

    Hi Hasan

    I would recommend doing a disk check on the machine, perhaps there is a bad sector.

    Alternatively try a different method of scanning. The sav32cli safemode scan can be found below:
    http://www.sophos.com/support/knowledgebase/article/13251.html

    If this also stops at a certain point, it is more likely to be the disc.

    For the removal of the threat.

    Where is it located? System restore or a recycler folder or in a normal folder location?

    Have you tried to remove it manually?

    It might be worth while to check the event viewer for any errors. That might lead us to a more precise conclusion.

    :)

    :13787
  • 0

    Hi wickedkittenz,

    first of all, thanks for your reply.

    I did a disk check with Windows, but it did not report any error. I just run the “sav32cli” information scan and Sophos was able to complete it. Does this means that no bad sectors/errors are present on the disk? I was getting really worried about this point…

    However, Sophos identified more (!) viruses than what it previously indicated.

    In the log file:

    Quick Scanning

    >>> Virus 'Troj/Java-AF' found in file C:\Dokumente und Einstellungen\andrea\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\34\37db3fe2-13f2e60a
    Could not open C:\hiberfil.sys
    >>> Virus 'Mal/FakeAV-EA' found in file C:\System Volume Information\_restore{EDD4E194-6971-464C-B440-70B7DF8EDFC3}\RP423\A0493942.exe
    >>> Virus 'Mal/Generic-L' found in file C:\System Volume Information\_restore{EDD4E194-6971-464C-B440-70B7DF8EDFC3}\RP425\A0496094.exe
    >>> Virus 'Mal/SillyFDC-N' found in file C:\System Volume Information\_restore{EDD4E194-6971-464C-B440-70B7DF8EDFC3}\RP434\A0499719.exe
    >>> Virus 'Mal/Generic-L' found in file C:\System Volume Information\_restore{EDD4E194-6971-464C-B440-70B7DF8EDFC3}\RP435\A0502217.exe
    Could not open C:\WINDOWS\system32\drivers\sptd.sys

    3 boot sectors swept.
    228799 files swept in 1 hour, 4 minutes and 39 seconds.
    2 errors were encountered.
    5 viruses were discovered.
    5 files out of 228799 were infected.

    Shall I now go for the “SAV32CLI” disinfection scan now, correct?

    Thanks a lot,

    Andrea

    :13811
  • 0

    In the meanwhile I have disactived the "System Restore" option (wonder when that changed...).

    Restarted the computer.

    I have tried to do a complete scan of the disk using directly the "Sophos Endpoint Security and control" window, but after some 1231 units it gets stuck.

    I am running the information scan via command prompt.

    I will let you know how it goes.

    Andrea

    :13813