This article explains what to do next if there are alerts in the Sophos Central Admin or you receive emails regarding 'Malware not cleaned up'. By default the policy applied to the endpoint will include "Automatically clean up items that contain virus/spyware" therefore if there are any detections which have been unsuccessfully cleaned up further actions are required on the endpoint(s).
Applies to the following Sophos product(s) Sophos Cloud Managed EndpointSophos Cloud
Identify affected endpoint(s)
To remove malware on the affected computer:
Further assistance with malware infections and reinfections
If you encounter further issues from the steps above, Sophos recommend using the Sophos Malware Remediation Toolkit (SMaRT). See the procedures described in the downloadable SMaRT User Guide pdf
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.