Sircam "virus fragment", how do I get rid of this?

[mcse924]

We utilize two AV scanners on our network. Mcafee VS is on the desktops and servers, and they perform normal nightly scans on local disks. Sophos is running on one network server, and it scans itself AND specific, common, network shares (home directories, file stores, user profiles, etc) every night as well.

Problem is SOPHOS is detecting a "Sircam-A virus fragment" during a scan, and Mcafee does not pick this up. It cannot clean the file, and I instruct to rename it. The file is a Lotus Notes database arhive (filename.nsf). My assumption is that because it's a "fragment", Sophos can somehow report it and McAfee cannot even see it.

Now the big question, how do I get rid of this "fragment" once and for all, without having to delete the file?

Carpe diem, procrastination is the thief of time...

 

[Xemus]

Is it possible to unarchive the file? Archives, like system restore, are generally hard for antivirus software to work with.

http://www.closedsocket.com

 

[mcse924]

I emailed Sophos support on this. They explained that there is probably an infected e-mail within the archive file triggering the alert. Of course, the best way to clean/disinfect/remove the affected email is to use their email scanning product, Mail Monitor. Unfortunately, we don't have a license for it, but no problem, Sophos would more than happy to sell us a license for X hundred dollars!!

Go figure...

Carpe diem, procrastination is the thief of time...