Reply
Employee
Agile
Posts: 1,191
Registered: ‎11-02-2010
0

Re: Removing Mal/Phish-A and Mal/EncPk-MK manually

Your question has been moved to the correct thread.  You need to create a custom scan that is set to delete the detected file.

-
Andrew
Threat Researcher
SophosLabs


For our other self-service and peer-to-peer online support systems:


Frequent Visitor
USMousie
Posts: 3
Registered: ‎03-08-2011
0

Re: Help with Creating a Custom Scan to remove a Threat

"I'm using a Mac OS X"  "Go to the icon and right-click on it" isn't there a disconnect here? lol

Employee
Agile
Posts: 1,191
Registered: ‎11-02-2010
0

Re: Help with Creating a Custom Scan to remove a Threat

Not really; control-click and contextual menus have been a part of OS X from the beginning.

 

But if you like, I could have said "click on the icon, and then click the gear button on the Finder window and select...."

 

Sometimes, right click is truly simpler, and Apple finally admitted it 11 years ago.

 

And don't get me started on function keys vs Apple's F-Keys with all their command-shift goodness....

-
Andrew
Threat Researcher
SophosLabs


For our other self-service and peer-to-peer online support systems:


Occasional Visitor
merril444
Posts: 1
Registered: ‎01-02-2011

Re: Help with Creating a Custom Scan to remove a Threat

This is what worked for me, step by step:

 

The 3 threats found after my first full scan on my Macbook were 

 

users/myname/library/cache/java……

 

which needed to be cleaned up manually.

 

In the Quarantine Manager, click on the blue link file name of the threat to get it's details.

You need to note the path & file name.

In my example I will use users/myname/library/cache/java……

 

You will need to make a custom scan.

 

1. In the window that's titled Scan Local Drives, click on the arrow next to Custom Scans

 

2. Click on the + sign.  You will see a message untitled - No items in scan, this scan has never been run.

 

3. Double click on it and another window will open asking for a Scan Name (can fill in later).  At the bottom of this window, click the + sign - this       will open a finder window called Open.

 

4. Double click on the file called Users (another window opens)

 

5. Double click on the home file with your name on it (another window opens)

 

6. Double click on the Library folder (another window opens)

 

7. Single click on the Caches folder and then click on the Open button bottom right

   You should now see the folder Caches with a tick next to it in the window described in step 3.

 

8. Type in whatever name you want to call the custom scan.  I called mine Caches.

 

9. Under the title you've just typed are 3 buttons. Click on the Options button.

 

10. Click on the drop down menu where it says log only and choose Delete threat.  So it now says When a threat is found: Delete threat.

       Click on the Done button.

 

11. In the customs scan window from step 1. you should see a new custom scan called Caches (or whatever you named it).  Click on the Play           button next to the pencil button.

 

12. A drop down dialogue box asks you to Scan with privileges, Cancel or Scan All.

      Click on the Scan All button & type in your administrator password & click OK.

 

13. The scan is performed.  If you Open Quarantine Manager, the threats should be gone.  

 

Cheers.

 

Advisor
rolls63
Posts: 11
Registered: ‎11-03-2010
0

Re: Help with Creating a Custom Scan to remove a Threat

Much more detailed than my instructions :smileyhappy: thanks Merril444.  Let us know how you get on if you managed to clean up.

Occasional Visitor
jamesog
Posts: 1
Registered: ‎01-05-2011

Re: Help with Creating a Custom Scan to remove a Threat

Thank you Merril444 for taking the time to write this brilliant piece of tech writing. I followed it word for word, was led correctly through every step of the process with no uncertainty or ambiguity in the text. A glowing example of really good instructional writing.

Occasional Visitor
maraiahlynn
Posts: 1
Registered: ‎03-28-2011
0

Re: Help with Creating a Custom Scan to remove a Threat

Brilliant. Ditto to above praise. I'm new to Sophos today, scanned the whole computer and found 3 Trojans hiding in my Google Chrome Cache. I was quite at sea as to how to do the requested Custom Scan. I followed your instructions exactly and it worked perfectly. Thank you so much for taking the time to spell it out so well.

Occasional Visitor
stickman
Posts: 1
Registered: ‎05-21-2011
0

Re: Help with Creating a Custom Scan to remove a Threat

ok, so I followed step by step.

/Volumes/Time Machine/Backups.backupdb/jeff  watson’s Computer/2011-01-02-004254/Macintosh HD/Users/annandwil/Downloads/Ben Folds Collection/The Unauthorized Biography of Reinhold Messner/hospital song ben folds five.mp3

/Volumes/Time Machine/Backups.backupdb/jeff  watson’s Computer/2011-01-02-004254/Macintosh HD/Users/annandwil/Downloads/Battlefield 1942 + Expansions/Patch + keygens/Keygens/Battefield 1942.exe

 

At this point I did a custom scan selecting the specific backup where the threat existed (Time Machine), choosing delete in options.  It did not get rid of threat so I reran with option of cleanup/delete.  Threats still there.  So went in to manually delete and get this message: "The operation can't be completed because backup items can't be modified."

 

Suggestions?

 

Any help is greatly appreciated,

 

Stickman

SiD
Occasional Visitor
SiD
Posts: 1
Registered: ‎02-09-2011
0

Re: Help with Creating a Custom Scan to remove a Threat

[ Edited ]

Thank you so very, very much for this fantastic step by step post Merril444!!!   All threats on my mac are now gone!  And I am very happy!  I am a computer moron and you made this easy for me.  I didn't think that was possible.  Thanks again!   :smileyvery-happy:

Occasional Visitor
waynebeamer
Posts: 1
Registered: ‎03-01-2011
0

Re: Help with Creating a Custom Scan to remove a Threat

Hi merril444,

 

Your instructions were more straight-forward and clear than those of Sophus employees. I've bookmarked this page on the likelihood I'll forget some of these details and have to refer back to them. THANKS!

 

Cheers!

 

Wayne