Sophos Anti-Virus for VMware vShield: On-Premise Edition
5.2 Manual cleanup
If automatic cleanup fails or is not supported, or if you don't have it enabled, you can deal with threats manually.
To clean up the affected guest VM:
1. Find out about the threat that has been detected.
This may help you to make the decision whether to restore the guest VM or attempt to clean up the current snapshot.
2. Clean up the affected guest VM by one of these methods:
■
Restore the guest VM.
■
Clean up a threat with Sophos Virus Removal Tool.
The choice of the method depends on whether or not you can accept the loss of data in your current snapshot and how the VM has been affected. Some viruses leave no side-effects.
Others may make changes or corrupt data.
3. Clear the alert about the threat detection from Enterprise Console.
5.2.1 Find out about a threat
To find out more about a threat and how to deal with it:
1. In Enterprise Console, in the computer list in the lower right part of the window, double-click the security VM to display the Computer details dialog box.
In the History section, Items detected are listed. The name of the threat is shown in the Name column and the affected guest VM and file are shown in the Details column.
2. Click the name of the threat.
This connects you to the Sophos website, where you can read a description of the item and advice on what actions to take against it.
5.2.2 Restore a guest VM
If you can accept the loss of data, simply restore the VM. Use one of these methods:
■
Revert the affected guest VM to the previous known clean snapshot.
■
Delete the affected guest VM and reclone it from the template image.
Make sure that the template image has all the required VMware and Sophos tools installed
(see the Sophos Anti-Virus for VMware vShield startup guide for more detail).
Whichever method you use, run a full scan of the guest VM afterwards to ensure that it is clean.
14
