Applies to: Sophos Home for macOS
What's happening
You receive a message that says File Encryption Blocked
Sophos Home Premium’s CryptoGuard component detects and blocks suspicious encryption processes that behave like ransomware.
If files have already been encrypted and there is at least 3 GB of free space on your computer’s hard drive, Sophos Home will stop the process and decrypt the files.
If there is not enough space, the process will be stopped, but the files will remain encrypted.
For more details on how this feature protects you, please see Information and prevention of ransomware
What to do
- Click on the File Encryption Blocked alert to show the event details.
-
Click the path to the file location.
- Perform the desired action
-
If you believe the detection is a false positive, and you are running a trusted application:
- Before proceeding, we strongly recommend to reach out to the application's vendor to ensure you are running a safe program or file.
- Click on View Dashboard to add the application to the Ransomware exclusions
- Restart your Mac and re-try running the application/file.
-
If you agree with the detection, delete the app or file to avoid further security problems:
- Permanently delete the malicious file or program.
- Click on the detected file or folder > press Option + Command + Delete (or right- click --> Move to trash, then empty the trash)
- Permanently delete the malicious file or program.
- Contact Sophos Home Support if you need assistance with these steps.
-
-
Run a full system scan to ensure the computer is safe.
Note: CryptoGuard requires 3GB of available hard drive space to perform file recovery tasks.
DISCLAIMER: The information in these articles is provided for general educational purposes only and is based on information available to Sophos at the time of publication. The materials may contain technical inaccuracies or typographical errors and may be updated, revised, or changed at any time without notice.
To the maximum extent permitted by applicable law, Sophos disclaims and excludes all representations, warranties, and conditions, whether express, implied, or statutory, including without limitation any warranties or conditions of title, non-infringement, satisfactory condition or quality, merchantability, and fitness for a particular purpose, with respect to the content.