Why a File Was Removed

When Antivirus finds something harmful in a file, it removes the file and leaves a locked card in its place. The card tells you what kind of harm it found.

What the card means

• Removed by Antivirus — the file was stopped as it arrived. It was never saved anywhere, so there is nothing to delete and nothing on your computer was affected.
• Locked by Antivirus — the file was saved earlier, and a later update found it harmful. It's now locked for everyone and can't be opened or shared.
• In an email, a line at the top says how many attachments were stopped. The rest of the email is safe to read.

The kinds of harm, in plain words

• Trojan — a harmful program dressed up as something useful.
• Password Stealer — tries to steal saved passwords and sign-ins.
• Ransomware — locks up your files and demands money.
• Backdoor — lets a stranger secretly take control of a computer.
• Worm — copies itself from computer to computer.
• Phishing — a fake page or form made to trick people into typing passwords or card details.
• Risky Macro — a document with hidden automatic actions that could run harmful commands.
• Exploit — built to take advantage of a weakness in the program that opens it.
• Disguised File — pretends to be a different kind of file, like a program dressed up as a PDF.
• Archive Bomb — a tiny zip that explodes into an enormous amount of data.
• Password-Protected Archive — locked with a password, so Antivirus couldn't look inside.
• Unwanted Program — not outright harmful, but does things you probably don't want.
• Harmless Test File — a file security teams use to check protection is on. Nothing to worry about.

What to do next

1. Don't try to get the file another way. If you weren't expecting it, the sender's own computer may be infected; let them know.
2. Ask for a safe copy. If you need the content, ask the sender to send it again as a plain PDF, or to share it differently.
3. If you're sure it's safe, choose I think this is a mistake on the card. See Report a False Alarm.

Your organization can't unlock a stopped file itself. That's on purpose: the same file may be shared across many organizations, and only the Antivirus team can clear it for everyone.