Hi all, Found a virus on a client PC. See attached screenshot, please. How do I get rid of this and/or submit to Sophos? Never done it before; don't know the process. Thanks!
since the screenshot is missing and you didn't name the threat I can't tell you how to get rid of it - but often the analysis gives some advice. The process of submitting samples is described in Submitting samples of suspicious files to Sophos.
the Restart required in the Cleanup Status column means just that - the threat has for the major part automatically been cleaned up but a reboot is required to complete the process. You should run Scan my computer after reboot to make sure the threat is gone.
Well, the PC has been rebooted several times since this virus was discovered and that status hasn't changed. And I can't use the "Submit a Sample" form because there's no actual file to submit. :-(
Sophos detects the various components of this malware as follows:
• Mal/EncPk-ALC • Mal/ZAccConf-A • HPmal/ZAccess-A (proactively via HIPS) • Troj/ZAUMem-C (in memory, e.g. during cleanup)
If the detection is in memory you may want to try the Sophos Bootable Anti-Virus tool (so the OS is not loaded and all files have to be on disk - and not in memory).
