Sophos InterceptX is showing Threats but not auto cleaning them

Hi Vicky,

Intercept X is the correct group to raise this - https://community.sophos.com/products/intercept/

Assuming you ran the malware somehow and an alert [which type of alert was it?] was issued, a Sophos Clean scan is triggered which needs a working internet connection to convict a file which might be a very new malware. 

We are interested to have a copy of the file submitted. Please let us know the Case ID which gets generated post your sample submission and we'll get to the bottom of this. 

Thanks,

Vikas

below was the email i received:

What was detected: Exp/201711882-U

User associated with device: domainname\username 

How severe it is: High

What Sophos has done so far: We attempted to clean up.

What you need to do: In the Sophos Central Admin console, go to the Alerts page and find the threat alert. Click on the threat name to see details and cleanup advice on the Sophos website. Then go to the affected computer and clean up the threat manually.

it should clean it automatically, there are user who are not good with the computers so manual cleaning is not an option for them.

Seems to be a Zipped malicious document which potentially exploits a vulnerability named https://nvd.nist.gov/vuln/detail/CVE-2017-11882 

.

Can you confirm if the detection has been made on an Archived/ZIP file?

It was a doc file not a zip file

It was a doc file not a zip file

A screenshot/log to be posted here wouldn't be recommended as it could contain confidential information. If you're a licensed customer, raise a Support Ticket with us or feel free to send me a direct message - I'll be happy to help.