Troj/DocDl-IR

Hello,

Sorry for my reply.

Just brief-search about your "detection-name" and it's can be that.... current signature known just for Sophos-solution. And some of samples.. will be detected just by Sophos.

If you available to get/understand, which file detected with current "detection-name"... maybe you can to check with Sophos (not really found mail-addresses) about "false positive" there or... indeed malicious sample.

Or re-transfer file to F-Secure SAS (F-Secure Labs).

Also.. just because it's can be signature/sample known (or marked as malicious for safe file) just for Sophos... probably other tools can to ignore this too.  And it will be not really helpful to scan by other scanners;

But under community was some of topics about tools/solutions and tips/advices for your OS with some of links and examples. If I correctly remember most of them comes by "Rusli" - user.

Maybe you able to check/search it under community. Maybe it can be helpful. Sorry that.. not provided links.