Sophos is clearing the malware locally but malware is being detected again

Question

Hi 
 
 One of my endpoints have two malware detection event that says manual cleanup required. but after sometimes 2 more events come that malware was locally cleaned up. 
 
 but after that again the two events come that malware detected in the same file and manual cleanup required. 
 
 My question is that 1. if sophos was able to cleanup the malware locally why it is detected again? 
 2. What does malware locally cleaned up means? 
 
 I have given a screenshot where you can see malware detected and cleanup required at 9.51AM then was localy cleared at 10.40AM and again same thing detected at 3.50PM

Qoosh · Answer

For those who are curious, 
 This behavior appears to be related to the "Scheduled scanning" option "Enable deep scanning." - https://docs.sophos.com/central/Customer/help/en-us/central/Customer/concepts/ConfigureMalwareProtection.html#ThreatProtectionPolicy__scheduledscanning 
 If the on-access scanner detected files stored within .zip or compressed files/folders: The entire drive is scanned when the full system scan occurs as scheduled. The archive files aren't extracted for deeper scanning. This results in the event "Malware locally cleared" because the AV no longer sees the original detected file. 
 For any files you suspect may be false positive detections, we recommend submitting a sample of the file so that our Sophos Labs team can verify they're clean and prevent further detections from occurring. - https://support.sophos.com/support/s/filesubmission?language=en_US

Sophos is clearing the malware locally but malware is being detected again

Submitted a Tech Support Case lately from the Support Portal?