Manual malware cleanup on a Mac computer (Sophos Troubleshoot)

You can manually address threats via the Sophos Home shield, or by accessing the Sophos Home dashboard. See below for specific instructions, as well as different scenarios that may come up.

If the detection is located inside a Time Machine snapshot, you’ll need to access Time Machine, find the date/time listed in the detection and delete the file inside Time Machine (right-click on file –> Delete all backups of <file> ). See the video and steps below:

IMPORTANT:  Starting with macOS11 Big Sur, Apple has removed the ability to remove a single file from Time Machine. Instead, users can follow the below-listed instructions to remove the entire backup.
For further questions regarding this limitation, please reach out to Apple support.

Additional options from Apple regarding how to remove backups from Time Machine can be found here:
About Time Machine local snapshots (See section “How local snapshots use storage space”)

If the file path presented includes /Library/Mail/ then the malware is most likely contained inside an email attachment. Detection example: (Note the location including /Library/Mail, as well as the example threat name at the end)

1. Find the location of the detected threat through any of the following options:
   • Click on the Manual detection via the Sophos Home Shield and hover the mouse over the threat’s name to see its full path.  Click on the path to open it in finder *(please see Note at the bottom if the path doesn’t open in Finder).
     OR
   •  Log in to your Sophos Home Dashboard , locate the affected system and use the HISTORY tab to find the detection and its full path ,  copy  the path up until the threat’s name (do not include the threat’s name), then paste it on Spotlight (click on the magnifying glass at the top right –> paste the path and hit Enter to open the location in finder).
     Example
     
     Highlight and copy the path up-to the threat’s name – In this example:
     /Users/Username/Library/Mail/V7/99F4E063-CDE3-40C2-AC1A-0B85E37E6CAD/Recovered Messages ([email protected]).mbox/4F98FAC6-194E-49FF-951A-8CCC72E1B278/Data/Attachments/222/3/ 
     Then paste it in Spotlight (click on the Magnifying glass at the top right of your screen)
     
2. Delete the file by right-clicking on it –> Move to trash 
3. Empty the trash
4. Open your Mail program, use the search function to search for the threat’s name via “All” your inbox items to locate the email with the offending attachment, then delete it. 
5. On the Sophos Home Shield find the manual cleanup detection and hit Ignore 
6. Run a Full System scan

• *Note: To manually browse the Mail folder, click on the magnifying glass at the top of your screen and copy paste the following:
  ~/Library/Mail
• Hit Enter to open the folder
• Use the search bar at the top right to enter the threat’s name, once located, delete it by right-clicking on it –> Move to trash
• Ensure the Search section has “Mail” highlighted, otherwise, it won’t find the threat:

• Empty the trash

Follow the steps below to manually remove threats detected in a mounted disk image (.dmg file)

1. Click on the detection via the Sophos Home Shield

   

2. You will now see the path to where the threat is located. If the file path contains /Volumes/<disk name>, and the <disk name> is not Macintosh HD, Bootcamp or one of your external drives, the malware is in a mounted disk image. In the example below, we can see that the threat is in a mounted disk image volume called “Eicar”
   
3. Go to the Desktop and locate the mounted disk image with the same name as in the path. For example, if the file path contains /Volumes/Eicar, you should see an Eicar disk icon on the desktop.
4. On the keyboard, press control key and click on the mounted disk > select Get Info. Make note of the file path containing .dmg in the disk image field. See example below:                                                                                
5. Press control on the keyboard, then click on the mounted disk icon > select Eject.                                                                  
6. Once the disk is ejected, locate the dmg file identified in Step 4 and delete it.
7. Empty the Trash
8. On the Sophos Home Shield find the manual cleanup detection and hit Ignore 
9. Run a Full System scan

If the file path points to /Volumes/BOOTCAMP/, the detection is located in the bootcamp backup.

1. Find the location of the detected threat through any of the following options:
   •  Click on the Manual cleanup detection on the Sophos Home Shield and hover the mouse over the threat’s name to see its full path.
     OR
   •  Log in to your Sophos Home Dashboard , locate the affected system and use the HISTORY tab to find the detection and its full path.
2. Make a note of the full path where the threat is detected.
3. Reboot the Mac into Windows.
4. Using Windows Explorer, browse to the location of the threat and delete it manually. (If Sophos Home installed on the Windows operating system, run a full scan after the cleanup).
5. Reboot back to MacOS and run a Full System scan .

The folders /tmp, /private, /var are temporary folders and should be automatically emptied upon restart. If you see a detection in one of these folders which requires a manual cleanup, restart the Mac and run another Full System Scan to ensure the threat is now gone.

Source : Official Sophos Brand
Editor by : BEST Antivirus KBS Team