"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
IssueThe on-access scanner displays a desktop alert whenever the on-demand scanner moves a file to a specified 'infected files' folder (i.e. a file/folder you have set-up specifically to store infected items). This is despite an on-access alert message: 'Access to the infected file denied'.
If the on-access scanner has also been configured to move infected files to your specified 'infected files' folder (which differs from the on-demand setting), then the on-access scanner grabs them from the on-demand folder and puts them in your specified 'infected files' folder.
Sophos product and versionSophos Anti-Virus for Mac OS X
This behaviour is by design. However, if you specifically wish not to see it, configure the on-access scanning exclusion list to specifically exclude the on-demand folder where infected items are stored. Details of how to do this are in the Sophos Anti-Virus for Mac OS X online Help
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.