PcDude

The article mentions how to push out the change to all clients using the share that they update from. That may be the easiest way. Sophos Anti-Virus version 7: End of life

It doesn't always have to be pirated; you could just be unfortunate enough to download, what looks to be, legitimate software: http://www.youtube.com/watch?v=RTeSYmQS820&NR=1 Also Sophos lists several pages of Mac malware (stuff you probably don't want on your Apple computer): Sophos website search I think Anti-Virus (OK, Anti-Trojan - for the present, who really knows what's round the corner?) software for Mac should just be seen as an increased level of protection that a lot of people do want (for the peace of mind) so they feel safe, especially in a mixed operating system environment. Personally, if I was in charge of a network, I would like the choice (sort of take it or leave it) of a security product for every operating system on that network. I would welcome a vendor who recognises the potential for a security weakness (however slight, even if it is just a Mac user copying files to a Windows server's share) and takes the responsibility to provide a comprehensive, multi-tiered security solution that I can pick and choose from. The way I see it: Windows didn't have viruses at one point. Firefox didn't have the same number of issues that Internet Explorer was having at the same time. As their respective popularity grew the profiteers moved in. The Mac's popularity is growing and will most likely attract the attention of the wrong sort of people when they know they'll get a return on any "investment" they decide to make. TTFN. P.S. Written on a Mac )

Sophos Anti-Virus for Windows 2000+: removing W32/Confick and Mal/Conficker ...very informative!

Have you seen: Understanding NAC

So a network of standalone computers it is then. I feel I know how Sophos works so I know how to work with it. I also know how I would like Sophos to work; how it could be better. However it currently is what it is (a strong player in computer security) and, I feel, it's getting better all the time - the HIPs protection really helps with Conficker. I get the sense that because the LEA buys a lot of Sophos licences and hands them out to lots of schools quite a few comments here are from members who feel trapped and therefore resentful. And if Sophos offer a good price, a competitive price, it's seen as cheap and nasty. To all I ask... Are you making sure you're planning deployments and pro-actively calling their support to get advice? Do you have a test environment that mirrors (blemish for blemish) your production environment? Have you read all the .pdf files for all the products they run? Have you considered asking Sophos to visit your site for consultancy and best practice? Sophos case study - Hamilton College Sophos Professional Services - maximizing your return on investment Have you seen the whitepapers available on Sophos' website https://secure.sophos.com/security/whitepapers/index.html Have you all subscribed to their email notifications Sophos email notification I'm sure I'm in for some hot replies. Please believe me it's not my intention to provoke people. Instead just lean back from the keyboard for one minute (go on, do it) and think about the last time you truly planned, tested, refined, tested, refined, sort approval from Sophos and then deployed in a phased rollout - monitoring as you go. If any abnormal effects are then seen you can pause and review. Honestly - don't hate me! It's just nice to debate. Isn't it...?

All I can see is that no one can agree around here. The best solution is as clear as mud. If someone had to choose an AV solution from the postings on here they might just shoot themselves for a short, pain free death. That article shows Sophos apologising for their mistake. To err is human to forgive is divine?

I'd be interested to know what you use? What's so bad about Sophos anyway? I think it's quite good but you've got a real downer on it?

I think this is what you're looking for: Sophos Anti-Virus for Windows 2000+: suppressing the post-upgrade reboot request Summary: (1) grab the CID's (ESXP, SAVSCFXP folder) configuration as a xml file (2) add the line it mentions (3) apply the updated xml file back to the CID (4) machines updating from that CID will pull down the savconf.xml to their AutoUpdate\Cache folder and will know to hide the prompt. The default action is to prompt the currently logged on user to restart. The message appears for 30 seconds or so. After that the message dissappears but DOES NOT force a restart. The reboot is required to load in new drivers though SAV continues to function as normal.

Script to add Administrators group and SYSTEM account to all keys. NOTE: This is just adding! Please make a full backup of the computer before using this script. 1. Download and install SubInACL - Download details: SubInACL (SubInACL.exe) 2. Create a file named reset.cmd in C:\Program Files\Windows Resource Kits\Tools folder. 3. Edit the reset.cmd file with the following content. subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f subinacl /subdirectories %SystemDrive% /grant=administrators=f subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f subinacl /subdirectories %SystemDrive% /grant=system=f 4. Enter the following command into the Run... box under the Start Menu: "C:\Program Files\Windows Resource Kits\Tools\reset.cmd" 5. After a few minutes by processing subinacl, the permission will be reset. (Errors will pop up about keys that the script does not have permission to change, this is normal behaviour) FYI: "setowner=owner" will change the owner of the object e.g. subinacl /subkeyreg HKEY_LOCAL_MACHINE /setowner=MyDomain\Administrators

If you need to run a scan on a computer with Sophos Anti-Virus so the host operating system is not booted you could use Ubuntu. Sometimes files are locked open by the operating system or files are hiding themselves in various ways or perhaps the computer is struggling to boot properly because of the infection. This method also allows you to replace system files that have become infected with clean ones from a similar service packed machine. AT YOUR DESK: 1. Download Ubuntu live CD .iso and burn to a CD-R 2. Copy on to USB pen (upload to a website or copy to a Windows share): a: http://www.sophos.com/downloads/ide/ides.zip b: https://secure.sophos.com/support/updates/dp/full/linux.intel.libc6.glibc.2.2.tar.Z (Enterprise Security and Control licence required) c: the sav-script.sh file (attached to this post) AT THE INFECTED COMPUTER: 3. Now go to the infected computer and put the CD-R in the drive and boot the machine from the CD-ROM drive. Select your language and "Try Linux..." option NOTE: If required you can change the screen resolution by selecting from the dropdown menu at the top of the screen: System > Preferences > Screen Resolution 4. Move the three file to the Desktop of the computer (now running Ubuntu). 5. Mount the hard drive. On drop-down menu at the top of the screen select: Places > " (mine was called "6.4 GB Media"). A new icon should appear on the Desktop. Though you don't need to access the drive yourself, if you were click on the icon you should see a familiar file structure (WINDOWS folder, Program Files, Documents and Settings.. etc.) 6. Open an Terminal windows from the drop-down menu: Applications > Accessories > Terminal 7. Change directory to the Desktop: cd /home/ubuntu/Desktop NOTE: Linux filesystem is case sensitive so "desktop" is NOT the same as "Desktop" 8. Change the user to "superuser" (administrator) by entering: sudo su 9. Enter: chmod +x sav-script.sh 10. Enter: ./sav-script.sh The hard drive will be scanned with the arguments "-all", "-archive" and "-p". This means all files will be scanned including archive files (zips, cabs, etc.) and a log file will be created on the Desktop that you can refer to later (i.e. copy off the machine). You could also add the argument "-remove". This will actually prompt you when a virus is detected as to whether or not you want to remove the file. Type "A" and press return. NOTE: The Terminal may not display the "A" you typed but it is there. NOTE: It is always best, if time allows, to scan the computer first without removing any files just to see what is there. A second scan can then be performed to action the presence of the viral file(s). Some people may feel that the instructions above are a bit fiddly. I should mention that Ubuntu is being used here as it has (1) excellent support for writing to NTFS filesystems and (2) allow you to mount USB devices and the local hard drive very easily. However (for those familiar with Unix/Linux) any other distribution of could work. There are "lighter" distros out there but they require much more Linux knowledge and may be missing vital packages. It's worth noting that there are other ways to create a boot "CD". You could put Ubuntu on a USB pen with the additional files and simply boot off that. However not all computers support booting from USB devices and I think the method above should work on most systems. Again you could also burn the ISO to DVD and include the files but the computer may not have a DVD-ROM drive. Hope this helps. WARNING: Caveat Emptor. I've used this quite a few times and it works very well. However you must understand that you are attacking the OS in a way that mean ANY file can be deleted. If you were you delete core system files the machine may not boot. Backup any important files to a remote locate before scanning the drive. sav-script.zip

AV companies are always going to be cagey about false positives. They even dream up little terms for them. If you contact Sophos mention "unwanted detection". lol

If you want to know more about the detection send Sophos a sample of the files by uploading them here: https://secure.sophos.com/support/samples/ ...you should get a reply on what Sophos think.

You haven't mentioned what error you are getting? Something like "0x8004005 Unspecified error"? The Sophos Management service needs to (1) get to the database and (2) authenticate with the SQL server when it gets there. The database could be local, remote. Housed in an instance called whatever you like. Be MSDE or SQL. The SQL server might require SQL authenication or Windows AD. First check the SOPHOS3.mdf and SOPHOS3_log.ldf actually exist and you know where you are going (local, remote... read above). Check in the registry under Sophos\EE\Management Tools for DatabaseConnectionMS That's the string that tells the service where to go. You can do a UDL test (create a new txt document on the Desktop and call it anything.udl). Run it and select from the provider tab "CannotRememberRememberHowItStartsButItEnds..... for SQL Server" (about three-quarters down) and click next. Then enter the serverName\instanceName, select "Windows Intergrated" and then choose the SOPHOS3 database from the list. Click "Test connection" and hopefully it should work. Click OK and then edit the UDL with notepad and compare the provider string with what's shown in the DatabaseConnectionMS string. While you're in the registry check a key beneath the "Management Tools" key called "DatabaseUser". If the windows intergrated option in the UDL file worked you don't need any credentials in here. Rename the "DatabaseUser" key to "DatabaseUserOLD" and try and start the service. TTFN

You can delay Sophos updating at login. It'll wait until the scheduled delay has expired (default five minutes which you can change centrally) and then it'll call ALUpdate.exe process. The link is... Sophos Anti-Virus for Windows 2000+: disabling updates on power-up Regards, PcDude