Sophos Enterprise Console
56
Note: Alternatively, you can go to the Security analyses page on the Sophos website
( http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware.aspx
), go to the tab for the type of item you want to find, and either type the name of the item in the search box or look for the item in the list of items.
5.6.4 Clear endpoint alerts or errors from the console
If you use role-based administration, you must have the Remediation - cleanup right to clear
alerts or errors from the console. For more information, see Managing roles and sub-estates
(page 19).
If you are taking action to deal with an alert, or are sure that a computer is safe, you can clear the alert sign displayed in the console.
Note: You cannot clear alerts about installation errors. These are cleared only when Sophos
Endpoint Security and Control is installed successfully on the computer.
1. In the Endpoints view, select the computer(s) for which you want to clear alerts. Right-click and select Resolve Alerts and Errors.
The Resolve alerts and errors dialog box is displayed.
2. To clear alerts or Sophos product errors from the console, go to the Alerts or Errors tab, respectively, select the alerts or errors you want to clear and click Acknowledge.
Acknowledged (cleared) alerts are no longer displayed in the console.
For information about clearing update manager alerts from the console, see
Clear update manager alerts from the console (page 78).
5.7 Scanning and cleaning up computers now
5.7.1 Scan computers now
You can scan a computer or computers immediately, without waiting for the next scheduled scan.
If you use role-based administration, you must have the Remediation - updating and scanning
right to scan computers. For more information, see Managing roles and sub-estates (page 19).
Note: Only Windows, Linux and UNIX computers can perform immediate full system scans originated from the console.
To scan computers immediately:
1. Select the computers in the computer list or a group in the Groups pane. Right-click and select
Full system scan.
Alternatively, on the Actions menu, select Full system scan.
2. In the Full system scan dialog box, review the details of the computers to be scanned and click OK to start the scan.
Note: If the scan detects components of a threat in memory, the scan stops and an alert is sent to Enterprise Console. This is because further scanning could enable the threat to spread. You must clean up the threat before running the scan again.
help
5.7.2 Clean up computers now
You can immediately clean up Windows or Mac computers that are infected with a virus or have unwanted applications on them.
If you use role-based administration, you must have the Remediation - cleanup right to clean
up computers. For more information, see Managing roles and sub-estates
(page 19).
Note: To clean up Linux or UNIX computers, you can either set up automatic cleanup from the console (see
Set up automatic cleanup for on-access scanning (page 85)) or clean up the
computers individually as described in
Deal with detected items if cleanup fails (page 57).
If an item (for example, a Trojan or potentially unwanted application) has been “partially detected”, before cleaning up the affected computer you will need to carry out a full system scan of the computer to find all the components of the partially detected item. In the computer list, Endpoints view, right-click the affected computer and click Full System Scan. For more information, see
Partially detected item
(page 211).
To clean up computers immediately:
1. In the computer list, Endpoints view, right-click the computer(s) that you want to clean up and then click Resolve Alerts and Errors.
2. In the Resolve Alerts and Errors dialog box, on the Alerts tab, select the check box for each item you want to clean up, or click Select all. Click Cleanup.
If the cleanup is successful, the alerts shown in the list of computers will no longer be displayed.
If any alerts remain, you should clean up computers manually. See
Deal with detected items if cleanup fails
(page 57).
Note: Cleanup of some viruses causes a full system scan to be run on the affected computers, which tries to clean up all the viruses. This might take a long time. The alerts are updated at the end of the scan.
5.7.3 Deal with detected items if cleanup fails
If you cannot clean up computers from the console, you can perform the cleanup manually.
1. In the computer list, double-click the infected computer.
2. In the Computer details dialog box, scroll down to the Outstanding alerts and errors section.
In the list of detected items, click the name of the item you want to remove from the computer.
This connects you to the Sophos website, where you can read advice on how to clean up the computer.
3. Go to the computer and carry out the cleanup manually.
Note: The Sophos website provides special downloadable disinfectors for certain viruses and worms.
57
