Surpass - Secure Client (what a pain)

[Brax]

Anyone getting Sophos blocking the latest version for ransomware?

All ok here, I've updated a few and run the system tests OK.

[ITGuyNW]

hmmm had no issue in previous years but this client aint playing ball this year. Keep getting the offline error.

[free780]

Anyone getting Sophos blocking the latest version for ransomware?

 

Glad I was sitting down when I read that. Made me smile.

[Brax]

Glad I was sitting down when I read that. Made me smile.

It's very secure:cool:

[ITGuyNW]

Does anyone just use the HTML delivery instead? The client this year just aint working for us, either offline or the clipboard error (done the usual proxy details, smoothwall exceptions, uninstalled impero etc).

[mikes]

It wouldn't let us use the HTML delivery method, we are with the WJEC however. The WJEC specifically said we have to use the Windows client we can't use the HTML one, I guess the WJEC haven't set it up yet?

 

Speaking of the client, we are trying to push the MSI out with SCCM using the /QN silent installer - it works fine if the machines don't have the older version of Surpass installed - but if we try to deploy it to a machine that has last years version - it won't overwrite it?? and so the old version gets stuck in the stupid update loop. Does anyone know if there is a fix?

[jthompson]

Speaking of the client, we are trying to push the MSI out with SCCM using the /QN silent installer - it works fine if the machines don't have the older version of Surpass installed - but if we try to deploy it to a machine that has last years version - it won't overwrite it?? and so the old version gets stuck in the stupid update loop. Does anyone know if there is a fix?

 

Does this help as a bit of a workaround? Installing it to a different location - http://www.edugeek.net/forums/educational-software/226780-secureclient-surpass-update-loop.html#post1945610

[PotNoodleTech]

Notes:

Your server share 'SecureClient' folder should contain the Surpass folder and its contents. If you're using this for more than one exam board, you can install it separately into other folders under 'Surpass' and change the install paths to reflect them.

The example group shown is Students (you may wish to use Authenticated Users but don't use Everyone) Modify permission to the install directory.

 

I have tested this with a proper SecureAssess test account and it has uploaded. This was using a regular student AD account - local profile on Windows 10.

 

Cheers giving this a go today. Going to use a separate exam AD account so I can pre-log the pcs in in the morning of the exam.

 

One Q - I've downloaded the client installer - I assume I need to install this onto a sacrificial PC in order to get the actual client files to copy to the server share? Or did you just install the client actually on the server?

 

Wish me luck!

Edited June 7, 2023 by PotNoodleTech

[3s-gtech]

I installed it on my work PC (as admin, naturally). Any old dog to get the files into a template folder!

[ITGuyNW]

We got students to do the paper version instead in the end

[mikes]

We ran an exam in 2 rooms with about 40 students for our Digital Technology exam so far they seemed to have uploaded OK, had one issue with a dodgy Ethernet port on one computer so it wasn't showing as uploaded for that student but once I swapped ports it showed as uploaded.

Problem is with scheduling these computer exams - they had lessons in before the GSCE so I had 10 minutes to get 2 rooms set up for this GSCE!! so we had 1 kid with a spacebar that was dodgy because the kids love pulling the metal bars out, and the room was very stuffy, a paper exam in the hall would be much better IMO. But I guess you'd have to compare results from schools doing it on computer and schools doing it on paper to find out.

 

But if they really do work better on computer isn't that unfair to pupils whose schools make them do the exam on paper???

[Brax]

We ran an exam in 2 rooms with about 40 students for our Digital Technology exam so far they seemed to have uploaded OK, had one issue with a dodgy Ethernet port on one computer so it wasn't showing as uploaded for that student but once I swapped ports it showed as uploaded.

Problem is with scheduling these computer exams - they had lessons in before the GSCE so I had 10 minutes to get 2 rooms set up for this GSCE!! so we had 1 kid with a spacebar that was dodgy because the kids love pulling the metal bars out, and the room was very stuffy, a paper exam in the hall would be much better IMO. But I guess you'd have to compare results from schools doing it on computer and schools doing it on paper to find out.

 

But if they really do work better on computer isn't that unfair to pupils whose schools make them do the exam on paper???

I feel you, Thankfully our Librarian and the staff are very good when it comes to exams and rooming, it gets booked out pretty much the day before so it gives us time to go in and check everything's working etc. Students pulling out space bars has gotten out of control here and we can't replace them as quickly as they're going. I've had to run Secureclient twice on machines to get and apply updates before it goes in as standard but now that they've sorted out the server issues on their end this has been pretty much pain free this year so far.

[PotNoodleTech]

I installed it on my work PC (as admin, naturally). Any old dog to get the files into a template folder!

 

Cheers used your script and worked perfectly - installed in IT suite this morning and exam completed this afternoon no issues.

 

Thanks!!

[3s-gtech]

Yup just put two groups through the exam today. I had two bug out - one said that the exam had to be manually uploaded? The other just went to a plain white page after entering the keycode. Neither could be made to work after that.

 

We issued paper exams to both.

[FragglePete]

Just been informed we're using this again next week for an exam - so looking at the latest version, getting it updated if need be, etc.

 

The new download has changed Publisher details - which made Applocker block the application. They changed the 'CITY' part of their publisher details to RIGBY from BRADFORD - Applocker said... "NO!"

 

Fixed that, but now on the first run it pulls down an update and insists on being restarted - even though this is meant to be the latest and greatest version.... This. Software.!!!!

 

Pete

[Brax]

Just been informed we're using this again next week for an exam - so looking at the latest version, getting it updated if need be, etc.

 

The new download has changed Publisher details - which made Applocker block the application. They changed the 'CITY' part of their publisher details to RIGBY from BRADFORD - Applocker said... "NO!"

 

Fixed that, but now on the first run it pulls down an update and insists on being restarted - even though this is meant to be the latest and greatest version.... This. Software.!!!!

 

Pete

Yep... and then you try to run it again and it still thinks there's an instance running in the background.

[Jaan]

We just updated wjec today..... exams taking place...... they all start closing mid exam........ we get this from Sophos.......

 

 

 

 

Sophos Central Event Details for X School

 

What happened: We detected ransomware trying to encrypt files.

 

Where it happened: G31-17

 

Path: C:\Users\Public\Surpass\SecureClient_WJEC\Surpass Secure Client.exe

 

What was detected: CryptoGuard

 

User associated with device: User name

 

How severe it is: High

[mavhc]

We detected software trying to encrypt files, which could be ransomware if it were encrypting every file, but we're not smart enough. Wonder what it thinks about Zip files with passwords?

 

Was there no test exam?

[FragglePete]

Just had this as well - kicked out a couple of students after they had entered answers to two questions. Moved them on to new computers and logged back in and thankfully those two questions had their answers saved.

 

Have added a Global Exception in Sophos Cloud - thankfully only happened on a couple of computers, but it could have been a disaster.

 

Pete

[Tester2000]

We keep getting this too at our sites. Sophos didn't mark any tests in the last few weeks as ransomware, however marked a dozen or so of our active clients as ransomware today across multiple schools.

 

We've also suffered with the random clients crashing/closing and partially crashing file explorer at the same time. This ends up requiring the client to be restarted again, sometimes also requiring a computer restart to successfully launch, as it will check for updates but progress no further.

 

We also had the update problem, where the new updated version had been installed on our clients, the client shows the new version number as installed, but when you launch it, the program gets stuck in a "you must restart to apply updates" loop on random machines. The fix for that so far has been to uninstall the client again and reinstall again, sometimes requiring this 2 or 3 times before it will launch successfully.

 

We've never had such issues with it in prior years. It has caused exams and ourselves plenty of headaches this time around.

[Jaan]

Just had this as well - kicked out a couple of students after they had entered answers to two questions. Moved them on to new computers and logged back in and thankfully those two questions had their answers saved.

 

Have added a Global Exception in Sophos Cloud - thankfully only happened on a couple of computers, but it could have been a disaster.

 

Pete

 

Could you share a screenshot of the rule you have in place in Central please?

 

Is it a path or process expectation you've added?

 

cheers

[FragglePete]

Done it this way for now. Ideally, their app needs to be submitted to Sophos (and other well know AV Vendors) to get it's unique signature so AV Apps know about it. Ideally that should be done by any self respecting software developer. Oh.... wait....

 

 

Pete

[Jaan]

Cheers

[mavhc]

Also what idiot programmers put code in C:\Users\Public?

[3s-gtech]

See thread for answer to that one.