Why a File Was Removed
When Antivirus finds something harmful in a file, it removes the file and leaves a locked card in its place. The card tells you what kind of harm it found.
What the card means
- Removed by Antivirus — the file was stopped as it arrived. It was never saved anywhere, so there is nothing to delete and nothing on your computer was affected.
- Locked by Antivirus — the file was saved earlier, and a later update found it harmful. It's now locked for everyone and can't be opened or shared.
- In an email, a line at the top says how many attachments were stopped. The rest of the email is safe to read.
The kinds of harm, in plain words
- Trojan — a harmful program dressed up as something useful.
- Password Stealer — tries to steal saved passwords and sign-ins.
- Ransomware — locks up your files and demands money.
- Backdoor — lets a stranger secretly take control of a computer.
- Worm — copies itself from computer to computer.
- Phishing — a fake page or form made to trick people into typing passwords or card details.
- Risky Macro — a document with hidden automatic actions that could run harmful commands.
- Exploit — built to take advantage of a weakness in the program that opens it.
- Disguised File — pretends to be a different kind of file, like a program dressed up as a PDF.
- Archive Bomb — a tiny zip that explodes into an enormous amount of data.
- Password-Protected Archive — locked with a password, so Antivirus couldn't look inside.
- Unwanted Program — not outright harmful, but does things you probably don't want.
- Harmless Test File — a file security teams use to check protection is on. Nothing to worry about.
What to do next
- Don't try to get the file another way. If you weren't expecting it, the sender's own computer may be infected; let them know.
- Ask for a safe copy. If you need the content, ask the sender to send it again as a plain PDF, or to share it differently.
- If you're sure it's safe, choose I think this is a mistake on the card. See Report a False Alarm.
Your organization can't unlock a stopped file itself. That's on purpose: the same file may be shared across many organizations, and only the Antivirus team can clear it for everyone.
