rockin

Hi Ricki, These are 2 different issues. the '..not yet managed..' problem is to do with the remote management side: Sophos small business solutions: 'Error fffffffd' is reported in the Sophos Control Center (either not installed, firewall issues, or different certificates - due to console reinstall?) The 1920 error is usually failure to start the service, if it is for SAVXP (with the autoupdate log will show), then you can check the MSI logs: usually %temp%\ Good trick with MSI logs is searching for "value 3" - above this should tell you the customaction / entrypoint / function it was doing before it failed. If it is a 1920 error: Sophos Anti-Virus for Windows 2000+: troubleshooting error 1920 during installation It is usually a permission problem on the system. Registry of files, or msxml. Hope that helps Rockin.

Hi Frazer, re: "Can anyone explain to me why, if your machine has been cleaned, patched, sophos fully up to date (on-active scanner is active for files on read+write) are machines still being infected?" Conficker has three ways to get on a machine 1) vulnerability 2) File sharing 3) USB If you have patched, you have stopped no 1. Even with an anti-virus enabled, it can still use no 1. It needs admin access as it uses C$/admin$ to connect to machine. An infected machine will try and guess admin passwords, or use the logged on account. If it has the rights, it will drop the DLL (odd extension) in System32. With the AV enabled, it will stop it loading so wont actually be infected, it will have a malicious file on it and a scheduled task attempting to load it. This is why Task Scheduler should be disabled so it cannot attempt to load. The best way to stop it is blocking file sharing access between clients - this stops them being reinfected. Or, setup Wireshark (or SMB file sniffer) on a machine that keeps getting the file dropped - this way, you can find out which machine is dropping it. Usually you will find a weak point where a machine has no AV etc. Hope that helps. Rockin.