Dealing with Viruses and Suspicious Files in Quarantine
From time to time, you should check the Quarantine Manager to see if any files have been infected on your system:
- Click "Manage quarantine items" in the Main Window. You will see the following display:
Click the "All items" drop-down menu button, then select "Viruses/Spyware," "Adware/PUAs," "Suspicious files" or "Suspicious behavior." Information about each item will appear in the columns:
- Type shows the kind of threat Sophos detected (Virus/Spyware, etc.).
- Name displays the identity that Sophos has detected. To learn more about the item, click the name, and Sophos connects you to the analysis of the file on the Sophos website.
- Details displays the name and location of the item. If the item is associated with a rootkit, it is displayed as "Hidden."
- Available actions shows actions that you can perform on the item. Unless the item is hidden, there are three actions: Authorize, Delete and Move, described below. If you click one of the actions, the action is performed on the item, following confirmation. Hidden files can only be authorized.
To deal with the suspicious files, use the buttons described below:
- Select All/Deselect All: Click these buttons to select or deselect all the items. This enables you to perform the same action on a group of items. To select or deselect a particular item, select the check box to the left of the item type.
- Clear from list: Click this to remove selected items from the list, if you trust them. This does not delete the items from disk, however.
- Perform action: Click this to display a list of actions that you can perform on the selected items. Click Authorize to authorize the selected items on the computer, if you trust them. This adds the items to the list of authorized suspicious items so that Sophos does not prevent them from being accessed. Click Delete to delete the selected items from your computer. Use this function with care. Click Move to move the selected items to another folder. The items are moved to the folder that was specified when cleanup was set up. Moving an executable file reduces the likelihood of it being run. Use this function with care.
If you delete or move an infected file, your computer may stop working properly because it cannot find the file.
To see the list of authorized suspicious files, click Configure authorization.
Local Mail Files in Thunderbird
A local mail file in Thunderbird contains many different messages in one mail "folder". If that mail file is deleted, all the messages in that mail "folder" are also deleted.