Sophos AV, AB Tutor Control, Win7 x86

[_techie_]

We are moving to Win 7 next summer, along with new hardware.

We are going to be using Sophos 9.5, along with AB tutor 6.7.1. I have had some issues with AB tutor, not removing policies properly, as well as small issues launching some things. Whilst this has been going on, Sophos has been quarantining (sp?) the ABclient.exe file as suspicious behaviour/buffer overflow and other items. I can only presume that Sophos has blocked the ABclient, prior to policiy removal, hence why it appears we cannot undo our policies properly!

 

Until then, can anyone who uses both Sophos, and AB provide me with any tips to give sufficient protection using Sophos Enterprise Console, whilst also allowing AB to work?

 

Thanks

Mark

[Michael]

Yes, you can just specify exceptions within the Sophos Enterprise Console and push this out as a Sophos policy.

[_techie_]

Hi,

 

Could you send me some screenshots of how you did this? I am aware of the exceptions, but it still seems to be getting caught and quarantined?

I can PM you my email if you wish.

 

Thanks,

[Michael]

I'm using Sophos EM 4.5.1 (for your reference).

 

Open up the console, expand 'Anti-virus and HIPS' and double click 'Default'.

 

Click 'Extensions and Exclusions...' > 'Windows Exclusions'

 

Enter the path as it would appear on the client e.g: C:\Program Files\Internet Explorer\iexplore.exe

 

Click OK.

 

Click on 'Configure...' > 'Windows Exclusions'

 

Again (as above) enter the path as it would appear on the client e.g: C:\Program Files\Internet Explorer\iexplore.exe

 

Click OK. Now you can either force the updated policy or wait for workstations to check in as normal.

[_techie_]

Cheers dude, I guess, its time to do some testing!

Thanks.

Mark