Automatic cleanup

The Security VM can automatically clean up threats that it detects.

Note Automatic cleanup is not available on CDs or other read-only file systems and media, or on remote file systems.

What happens when there is an automatic cleanup?

When a threat is detected and cleaned up automatically, Sophos Enterprise Console does as follows:

  • Shows that the threat has been blocked (see the "History" section of Computer Details).
  • Displays an alert that shows what the threat is and whether it is cleanable.
  • Removes the alert if cleanup is successful, and marks it as "Not Cleanable" if cleanup fails.

Occasionally a guest VM needs to be restarted to complete the cleanup. In this case, a "Restart required" alert is displayed for the Security VM. To find out which guest VM the alert applies to, double-click the Security VM to open Computer details and look in the description of the alert in Outstanding alerts and errors.