Help us enhance your Sophos Community experience. Share your thoughts in our Sophos Community survey.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 5 replies
  • Subscribers 12 subscribers
  • Views 6436 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

What does Sophos Intercept X Advanced do when it detects a file as infected? What is the next step?

Kandarp Desai1

Hi All,

One of our potential customers asked us what does Sophos Intercept X Advamced (cloud version) do when it detects a file as infected. According to me it follows this process but I am not sure that is correct.

Step 1- It will block access to the file

Step 2- It will try to cleanup file(if automatic cleanup is enabled

Step 3- If cleanup fails then it will ask for manual cleanup.

I want to understand what does CLEANUP mean. Will it remove the infected part and restore the original file?(very improbable as the virus could have messed with the file) OR does it directly go for deletion of file?

If some important file is infected, will Sophos directly delete the entire file? ( I say this because i tested this on one file and Sophos just deleted it and it says threats cleaned up) Does Cleanup= Delete OR blockaccess OR disinfect.

Can someone please help me to understand the sequence of decisions taken by Sophos on finding infected file?

I saw one explaination by QC in this thread too:



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to bad robot

    Hi Grifter,

    AFAIK, now this is like those memories in a shoebox under your stairs so someone may have to double check.

    If an exploit is detected, it is blocked then Sophos Clean is activated to examine the processes, files and memory segments in use for malicious activity. If clean detects the file in use has malicious content then i believe it removes the processes locks and attempts cleanup. If this fails it will re-attempt with the process closed.

    I'm fairly certain that is the case, but as i said that's a shoebox under the stairs memory.

    Emile

Unfiltered HTML