"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
A file that doesn't contain any blocked expressions is being blocked by the on-access scanner.
First seen in Endpoint Security and Control, version 9 Enterprise Console, version 4
The file may once have contained a blocked expression which has been deleted. The on-access scanner will find the text in the file's metadata and therefore block the file.
It is considered best practice to continue blocking deleted expressions, as recent news events have highlighted the problem of incorrect or confidential information from metadata (such as version histories) being published to public areas of the Internet.
If you would like to allow the files to be transferred in the case that the text is no longer visible in the file, we recommend that you set up the data control rule to allow the transfer on user acceptance. In this case, you should instruct your users to be very careful with the file and to avoid sending documents with metadata included (such as Word documents or pdf files).
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.