actually just run a scan on / as opposed to /home and it's found loads !
Here's a slice
Jim
Here's a slice
Quote:/var/sentora/vmail/mydomain.com/jim/cur/1471268924.M774576P18239.myvps.net,S=48391,W=49090:2,: Doc.Dropper.Agent-1619413 FOUNDHow do these things get on there ?
/var/sentora/vmail/mydomain.com/jim/cur/1471268924.M774576P18239.myvps.net,S=48391,W=49090:2,: Removed.
/var/sentora/vmail/mydomain.com/jim/cur/1471448859.M585418P13283.myvps.net,S=67886,W=68830:2,: Doc.Dropper.Agent-1631336 FOUND
/var/sentora/vmail/mydomain.com/jim/cur/1471448859.M585418P13283.myvps.net,S=67886,W=68830:2,: Removed.
/var/sentora/vmail/mydomain.com/jim/cur/1471448994.M79981P13299.myvps.net,S=68160,W=69108:2,: Doc.Dropper.Agent-1624405 FOUND
/var/sentora/vmail/mydomain.com/jim/cur/1471448994.M79981P13299.myvps.net,S=68160,W=69108:2,: Removed.
/var/sentora/vmail/mydomain.com/jim/cur/1471449473.M795831P13384.myvps.net,S=67754,W=68696:2,: Doc.Dropper.Agent-1624013 FOUND
/var/sentora/vmail/mydomain.com/jim/cur/1471449473.M795831P13384.myvps.net,S=67754,W=68696:2,: Removed.
/var/sentora/vmail/mydomain.com/jim/cur/1471449564.M617982P13397.myvps.net,S=67756,W=68698:2,: Doc.Dropper.Agent-1624013 FOUND
/var/sentora/vmail/mydomain.com/jim/cur/1471449564.M617982P13397.myvps.net,S=67756,W=68698:2,: Removed.
Jim