The Sophos Community will be offline for scheduled maintenance this Saturday, May 27th, at 13:00 UTC for approximately 1 hour. Apologies for any inconvenience caused.
"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
The article below describes how to disinfect macro viruses across the Sophos product range.
For more general information, refer to
You can disinfect macro viruses over a network using Enterprise Console or Enterprise Manager.
2. Disinfecting Macro viruses with Sophos Anti-Virus for Windows, versions 7 and 9
If Sophos Anti-Virus cannot disinfect files because they are held open by the operating system, make a note of the names of the files, then do as follows.
to access the CD drive. Type:
SAV32CLI -DI -P=C:\LOGFILE.TXT
to disinfect the virus.
All other files must be deleted. Some of these were dropped by the virus and need not be restored. Others should be recovered from backups.
SAV32CLI -REMOVE -P=C:\REMOVLOG.TXT
This command writes a report to the root of the C: drive. This report can be used to check which deleted files should be restored from backups.
In Windows 2000/XP/2003/Vista, when disinfection and deletion have finished, restart the computer in Windows.
Install or reinstall Sophos Anti-Virus then run an 'All files' scan to check that the virus has gone.
3. Mac OS X computers
4. NetWare computers
5. Linux computers
6. UNIX computers
7. OpenVMS computers
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.