Segurazo

[Dwee]

Hi,

maybe this is similiar to my old posts, i just frustrated that mcafee have option to detect PUP, but still in my system (many system checked on ePO) have this threat events from segurazo (variant a,b,c,d you named it), it only detected but not cleaned or delete it, even thou some times i found some system successfully delete or cleaned it it will come back again,

my questions : how to permanently kill this PUP (Segurazo), how to check the root cause why this PUP always/can comes back ?

this is the event id that always showed up : 1284 : file infected. Undetermined clean error, delete failed

[Pravas]

Hi @Dwee ,

ENS detects a threat when its accessed (read/write) in disk. It may not be able to block it from source.

Therefore its important to investigate how (Segurazo) gets installed.

Perhaps clean-up doesn't work because it may have been locked by some other process.  Try rebooting and verify if the file gets removed.

I believe file access should be denied even if the sample is not cleaned.

Thanks