Deal with alerts about ransomware
If you use role-based administration, you must have the Remediation - cleanup right to clean up detected items or clear alerts from the console. For more information, see Managing roles and sub-estates.
CryptoGuard blocks the process on the endpoint that has generated the ransomware alert. The block is only removed when you acknowledge the alert.
Note If the endpoint is restarted the block is removed. A new ransomware alert is
generated if the infected process restarts.
Remember You must manually run Sophos Clean on the computer triggering the
detection. If you do not, the computer will trigger the alert and the process will
be re-blocked every time it runs.
To take action against ransomware alerts displayed in the console: