Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 6 subscribers
  • Views 584 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Clean up or delete?

MartinStreet

I just installed SAF & it detected 5 threats. Opening the Quarantine Manager I found many MS Word docs but only one threat "OF97/Crown-C". These are very important files, so I need to know if I clean these files, will they be deleted in order to eleminate the virus. Also, why does SAF say 5 threats are detected but only one is shown in the Quarantine Manager?

thanks!
Greg 

:1006837


This thread was automatically locked due to age.
Parents
  • 0

    You have 5 documents that are all infected with the same macro virus.  The Quarantine manager is showing you that you have a single threat that has spread to five distinct files.

    OF97/ detections remove the malicious macros from the documents but leave the documents themselves intact.  If those documents contain other macros, there is the slight possibility that these macros will be affected -- however, NOT cleaning the malicious macros will ensure that any other documents you open in the same session as an infected document (including the normal.dot file if it's infected) will also become infected -- and if you send these documents to anyone else, their computers will also become compromised.  Best to clean up the macros and then restore from a known-good backup if you find critical macros are missing from your documents.

    :1006855
Reply
  • 0

    You have 5 documents that are all infected with the same macro virus.  The Quarantine manager is showing you that you have a single threat that has spread to five distinct files.

    OF97/ detections remove the malicious macros from the documents but leave the documents themselves intact.  If those documents contain other macros, there is the slight possibility that these macros will be affected -- however, NOT cleaning the malicious macros will ensure that any other documents you open in the same session as an infected document (including the normal.dot file if it's infected) will also become infected -- and if you send these documents to anyone else, their computers will also become compromised.  Best to clean up the macros and then restore from a known-good backup if you find critical macros are missing from your documents.

    :1006855
Children
No Data