Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Just got a bran-new work-issued macbookpro loaded with Symantec endpoint protection (not by choice), it's less than 2 weeks old. Created backup using the time machine software, and endpoint kicks in every time I plugged the drive in when i get to work, and started to scan the drive. I usually stops the scanning process.

This morning I plugged the drive in and went to get some coffee, when i came back endpoint identified a virus Bloodhound.PDF.20 on a file under ./DocumentRevisions-V100 in the backup folder. So I have a few questions: 1. /.DocumentRevisions-V100 require root access therefore endpoint can't scan into on my computer (not the external drive), that means it's likely the virus also resides on my computer as well? If so, how can get rid of it. I can't cd into further folders under .DocumentRevisions-V100 even with sudo command. Haven't tried sudo su yet.

  1. Is it possible to get endpoint to scan the .DocumentRevisions-V100 folder with root privilege?

I am going to reformat my external drive and start a new time machine session. At this point, my concern is my own computer and whether it has an virus or not.

Any suggestion is appreciated.

ps. Yes I've considered to rm -rf /.DocumentRevisions-V100 but it's heavily advised against after some googling

share|improve this question
add comment

1 Answer

When you delete a file, all the revisions go away, so you will want to first attack the file with the problem by deleting it.

If you can't delete it, move it to an external USB drive and then delete it.

At that point, you can let the scanner see if backup copies are still affected - but you are correct - you never want to use rm on backed up files. Delete them using the Time Machine interface to delete one file in all backups or one instance of one file or one backup instance. You can also use tmutil delete to remove snapshots from the backup drive.

share|improve this answer
    
file identified is /DocumentRevisions-V100/.cs/ChunkStorage/0/0/0/1, if i copy this file to an external drive, Symanetec picks it up immediately. Could this be a false positive? I am hesitating to remove this file manually since i don't know what it does. The filesize is 525k –  adjfac Jun 20 '13 at 16:03
    
After some digging it seems like it's just a "chuck" file. Some post suggested to delete it without problems (cause it was growing in size), at the moment, i am gonna leave it be just on the safe side. –  adjfac Jun 20 '13 at 18:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.