Deal with suspicious behavior in quarantine

Suspicious behavior is activity that appears to be malicious.

On the Home page, under Anti-virus and HIPS, click Manage quarantine items.
For information about the Home page, see About the Home page.
In the Show list, click Suspicious behavior.

Information about each item is shown in the columns.

Name displays the identity that Sophos Anti-Virus has detected. To learn more about the behavior, click the identity, and Sophos Anti-Virus connects you to the analysis of the behavior on the Sophos website.

Details displays the name and location of the item.

Available actions displays actions that you can perform on the item. If you have enabled blocking of suspicious behavior, there is one action: Authorize, described below. If you click the action, the action is performed on the item, following confirmation.

Dealing with the suspicious behavior

To deal with the suspicious behavior, use the buttons described below.

Select all/Deselect all

Click these buttons to select or deselect all the items. This enables you to perform the same action on a group of items. To select or deselect a particular item, select the check box to the left of the item type.

Clear from list

Click this to remove selected items from the list, if you trust them. This does not delete the items from disk, however.

Perform action

Click this to display a list of actions that you can perform on the selected items.

Click Authorize to authorize the selected items on the computer, if you trust them. This adds the items to the list of authorized suspicious items so that Sophos Anti-Virus does not prevent the behavior.

To configure what actions you can perform, refer to Configure user rights for Quarantine manager.

To see the list of authorized suspicious behavior, click Configure authorization.