Unable to delete manually files in quarantine

Question

Hi all,

Environment : Windows 2008R2 Server used as a file server

Running Sophos Endpoint Security and Control v10.2 on the server

The antivirus detected several infected files.

In the Quanrantine manager, under the "Available actions" column :

"no action (manual cleanup required)"

When trying to manually remove these files (with a basic Shift+Del), there is a message "Authorization Required" (as files are in quarantine).

Even the main domain administrator login is unsufficient.

How are we supposed to delete those files ?

All the best-

This thread was automatically locked due to age.

QC · Accepted Answer

Hello an_SMB_techteam, the detection is "normal" as Explorer usually accesses the file (depending on the settings this could be when you just browse the folder, when you hover the mouse pointer over it or when you click on it). Haven't seen the following behaviour but then this might as well depend on various settings. Did you try to get rid of it with an on-demand scan? To do so, open the SESC GUI -> Configure anti-virus and HIPS -> Right-click scanning . Make sure Scan all options in the Scanning tab are checked. On the Cleanup tab select Delete in the Viruses/spyware section. Then in Explorer right-click either the file or the containing folder and request Scan with Sophos Anti-Virus (as an aside, the On-demand exclusions are still respected). This should remove the file. Christian  :39325

QC · Answer

Good to hear it worked.

Right-click cleanup settings are not part of the policy - i.e. they are configured on the endpoint (whether workstation or server) only (the other centrally configured cleanup is for scheduled scans) and also do not cause non-compliance. That's one of the purposes of right-click (they others would be scanning an archive before opening it or other items normally not scanned by on-access).

.

Christian