Running malware in quarantine or cleanup failure

Hi Jeff, 

Can you please try the following suggestions and let me know if you are still seeing the alert?

> Reboot.
> Full Scan on the reported client machine.
> Resolve the alerts in the central console.
> Sophos clean scan (If the alert is still seen after the full scan)
> Confirm if the file is still present in the actual folder location.

Hi Jeff, 

Can you please try the following suggestions and let me know if you are still seeing the alert?

> Reboot.
> Full Scan on the reported client machine.
> Resolve the alerts in the central console.
> Sophos clean scan (If the alert is still seen after the full scan)
> Confirm if the file is still present in the actual folder location.

I rebooted, alert still present

I did full scan - alert still present

How do I Resolve the alert in the central console, when it does not even show me what the actual issue is?

I'm having the same issue. There is no threat on my device but I'm having a difficult time removing the alert.

Hi Jerry,

I found a way to clear the alert. Once you have verified that any threat has been removed, open Sophos Endpoint> Log in as Admin> Go to Events> Find the alert> Select "Ignore". Once the device communicates with Sophos Central, the alert will be removed there as well.

Hope this helps.

Mike

I am unable to find the option to ignore in the Sophos Endpoint.  And as you can see from the screen shot, I also can't read the full path to where the offending file is located. 

You have to select "Admin Login" and enter your credentials first

That did it, thanks

For those who don't know how to log "Admn Login", you need to go to Sophos Central, select your server in the Summary Tab, select Show Details for the Tamper Protect.  Select show password, copy and paste the password into the server for the "Admin Login". 

Michael Smith4 said:

Hi Jerry,

I found a way to clear the alert. Once you have verified that any threat has been removed, open Sophos Endpoint> Log in as Admin> Go to Events> Find the alert> Select "Ignore". Once the device communicates with Sophos Central, the alert will be removed there as well.

Hope this helps.

 Mike

 

Hi Shawn Lyman 

Can you enable remote assistance in your Central account and PM your license (Along with the client machine details) so that I can take a look into it? Since its past 90days, we might have to reach our backend team.

I would like to add to this answer. Only this solution below worked for us thanks to MarlonD at Sophos Support.

Basically you create a fresh new Sophos Endpoint Events database.

a. Turn off the Tamper Protection.

b. Press the keys Windows and R, then type services.msc.

c. Stop Sophos Health Service.

d. Go to C:\ProgramData\Sophos\Health\Event Store\Database and rename the file events.db to events.orig.

e. Restart Sophos Health Service.

f. Open the Task Manager and end the process Sophos Endpoint User Interface.

g. Launch a new Sophos Endpoint user interface by clicking the file C:\Program Files\Sophos\Sophos UI\Sophos UI.exe and verify that its status is green and the event count is 0.

h. Turn on the Tamper Protection.