how to clean/delete an uncleanable virus

Not all threats can be cleaned up using the console. And, if I may add, the current behaviour is a little bit confusing. 

First of all it depends on your AV policy - whether you enable automatic cleanup and what Sophos should do if cleanup fails or is disabled. Then an item may show up as cleanable but cleanup fails or times out (even though the client is online - never found out what this signifies) or results in some other error. See chapters 11 and 12 in SEC Help. Look at the computer details where it has been detected and which action has been taken (right now I see Troj/Badsrc-H on a client with both cleaned up for the URL and blocked for the Content.IE5 subdirectory ... it's no longer present on the machine, if it ever was). 

As you noticed you are referred to the Security Analyses (which you can also access by clicking the alert in Computer Details) but more often than not you enter a loop at this point unless you decide to pay the client a visit. Check the client's sav.txt - it should tell you where the threat has been found, this information is not always in SEC. You could then take a look if it's still there. Open the quarantine manager on the client - is it there? What actions are available?

If it is indeed gone acknowledge the alert from the console. If it recurs it could be the user re-visiting a malicious or hacked site. Sorry if this seems even more confusing.

In short - forget SEC for the moment and try to clean the client locally. If you then can't find out why it recurs, contact support. 

And another tip: To get a feeling how the various settings (On-access, Web-scanning, cleanup options and so on) affect the results (and alerts you will receive) take a client and play with it. Visit www.eicar.org for a nonhazardous sample.

Christian       

Not all threats can be cleaned up using the console. And, if I may add, the current behaviour is a little bit confusing. 

First of all it depends on your AV policy - whether you enable automatic cleanup and what Sophos should do if cleanup fails or is disabled. Then an item may show up as cleanable but cleanup fails or times out (even though the client is online - never found out what this signifies) or results in some other error. See chapters 11 and 12 in SEC Help. Look at the computer details where it has been detected and which action has been taken (right now I see Troj/Badsrc-H on a client with both cleaned up for the URL and blocked for the Content.IE5 subdirectory ... it's no longer present on the machine, if it ever was). 

As you noticed you are referred to the Security Analyses (which you can also access by clicking the alert in Computer Details) but more often than not you enter a loop at this point unless you decide to pay the client a visit. Check the client's sav.txt - it should tell you where the threat has been found, this information is not always in SEC. You could then take a look if it's still there. Open the quarantine manager on the client - is it there? What actions are available?

If it is indeed gone acknowledge the alert from the console. If it recurs it could be the user re-visiting a malicious or hacked site. Sorry if this seems even more confusing.

In short - forget SEC for the moment and try to clean the client locally. If you then can't find out why it recurs, contact support. 

And another tip: To get a feeling how the various settings (On-access, Web-scanning, cleanup options and so on) affect the results (and alerts you will receive) take a client and play with it. Visit www.eicar.org for a nonhazardous sample.

Christian