My antivirus flagged a file: what it means and what to do

An antivirus warning usually means your protection is doing its job. Here's what the common messages mean and what you should do.

What the messages mean

• Threat cleaned / deleted: the file was removed before it could run. Report it so we can check where it came from.
• Quarantined: the file has been locked away safely. Don't try to restore it. Report it.
• Potentially unsafe / unwanted application: legitimate software that could be misused, such as remote-access tools or an old or vulnerable driver. Tell us what it is and we'll decide whether it's allowed.
• Phishing / malicious website blocked: a link or page tried to steal details or deliver malware. Don't go around the block. Report the email or link.

What to do

1. Don't panic. A blocked threat is a good outcome.
2. Take a screenshot of the warning, or note the file name and time.
3. Think about where it came from: an email attachment, a download or a USB stick.
4. Raise a ticket with those details, even if the warning says the problem is fixed.

The same warning keeps coming back? This often means the file is still sitting somewhere, such as an email attachment, a Downloads folder or a synced cloud folder, and gets scanned again each time. Tell us, and we'll find and remove the source.

Never do this

• Don't turn off or pause your antivirus to "get something working".
• Don't restore files from quarantine or add exclusions yourself.
• Don't forward a suspicious attachment to colleagues to "see if it works for them".

If you think you've already opened something malicious, follow How to report a phishing email or security concern.