Sophos gone mad...hopefully

[arthur231283]

Is any one else having issues with sophos reporting a virus on all there workstation?

 

The e-mail I'm getting is:

 

Virus/spyware 'Shh/Updater-B' has been detected in "C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_update.exe". Cleanup unavailable.

 

Infected file "C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_update.exe" has been deleted.

 

I hope this is a false positive after sophos updating itself and not a major issue

[AliG]

yep getting a few dozen emails through to my phone

 

Sophos have said its a false positive but the problem i see is the updater is being quaranteened meaning how will it get the updated ide?

 

Apparantley if live protection is enabled it will fix itself. Hopefully the IDE will be updated before all of our pc's come on tomorrow!

[DrCheese]

I've just logged on remotely and killed the Sophos updater share for now. All our clients (well... 95% of them) are off anyway at the moment so they won't get a chance to pick up the fraked up IDE's.

 

I've got 52 machines tho (including servers) reporting it tho. All it's done is "blocked" them for now.

[AliG]

I was going to kill the share but its required to get the updated fix IDE?

[FN-GM]

Have a look at this - http://www.edugeek.net/forums/security/101481-oh-dear-sophos.html

[loustarrrr]

I've gotten this too, just had a load of emails come through on my phone from Sophos

[AliG]

looks like javab-jd.ide recieved at 22.20pm is released to fix this issue

[DrCheese]

I was going to kill the share but its required to get the updated fix IDE?

 

Aye, I did it until the fix was out. I might just leave it dead until the morning, when sophos have a proper fix out (rather than a rushed one )

[arthur231283]

Just checked my work e-mail and I have 615 unread all from sophos with the last one received at 5:55 reporting a virus on the computer that hosts the sophos enterprise console

 

So I assume I'm going to have a busy day!

[flyinghaggis]

+1 same here

 

Virus/spyware 'Shh/Updater-B' has been detected in "C:\ProgramData\Sophos\AutoUpdate\Cache\sophos_autoupdate1.dir\ALUpdate.exe". Cleanup unavailable.

 

Virus/spyware 'Shh/Updater-B' has been detected in "C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\alupdate.exe".

 

Virus/spyware 'Shh/Updater-B' has been detected in "C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\alupdate.exe".

 

I could almost let Sophos off for accidentally picking up other system updates as potential but to let the software decide that their own program is virus is just plain inept. Having said that given the amount of grief Sophos has caused us over the last couple of years maybe it's right to classify itself as a virus!

[psydii]

I've got to say this is the first time I've had Sophos cause me a headache since 2006. The fix looks easy enough, even for those of us mad enough to have 'delete' as the default action.(*)

 

Maybe. We'll see how it goes.

 

 

(*)Turns out I'm not that mad after all. Its always nice to discover you haven't made a terrible mistake!

Edited September 20, 2012 by psydii

[Miscbrah]

Yeah we got this too. Whoopdidoo.

 

A helpful chappy from the Sophos forums contributes thus:

 

Believe it or not, every last AV provider has had this screw up and some of them have been considerably worse than this. If a false positive has you in such a twist maybe you should stay clear of antivirus as a whole.

 

What a charming lad who definitely wouldn't benefit from a punch.

[newpersn]

Come in this morning to find out its put it self in the bin.... Im leaving it there....

 

[kennysarmy]

Having the same issues here....So whats the advice?

Wait for them to patch it or turn something off?

 

HEeelllpppp

[X-13]

Come in this morning to find out its put it self in the bin.... Im leaving it there....

 

[ATTACH=CONFIG]15240[/ATTACH]

 

[ATTACH=CONFIG]15241[/ATTACH]

 

I think I have you beaten.

[denon101]

[ATTACH=CONFIG]15241[/ATTACH]

 

I think I have you beaten.

 

Ding, Ding.... We have a winner!

[psydii]

Arguably that is only a mis-catagorisation. Sophos has detected RM Community connect as malware. It should be 'Potentially Unwanted Application'.

[newpersn]

Ding, Ding.... We have a winner!

 

Ill hold by hands up.... I lost