Endpoint Protection

There is a machine that I have run a full scan on, upgraded and cleared the logs from, the "J" drive is not even there any longer, but it still populates in the Still infected items as a virus..

j:\qcum.pif

That is what it finds, the drive has been gone for a week and the file is nowhere to be found. I want this gone from the still infected items, the logs are set to be cleared after three days, why does it continue to show up?

SEP Client and Manager are RU3

is it showing in the SEPM risk log? If so, check the remote source.
 

I see this happen when a remote host is infected.

It is in the still infected items.

I have checked the PC up and down, the drive isn't even there anymore.

When you click on Details, does it show a remote IP?

I checked the risk logs in the monitors and saw a bunch of old stuff, strangely enough that wasn't there.

I went to the monitors, and added that PC's IP, to the risks and it didn't even show.

No remote ip when clicking on details

Supoprt call

Can't take that kind of abuse late in the week. That's more of a Monday thing.

Gotta love it...

I am gonna remove it and re install it next week.

Cool. Lemme know how it goes. I have a feeling it's related to the DB though...