This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

v8.0.6C constantly writing to LaunchDaemons folder

One A/V technique is to employ an Applescript that monitors the /Library/LaunchDaemons & /Library/LaunchAgents folders, and posts an alert whenever a program tries to add something there. Since v8.0.6C was released, Sophos A/V for the Mac is constantly writing a new com.sophos.autoupdate.plist, com.sophos.intercheck.plist & com.sophos.notification.plist to the LaunchDaemons folder, triggering an alert. This appears to be happening as part of the auto-update process.

Please STOP this behavior on the part of Sophos A/V for the Mac.

Thank you!

This thread was automatically locked due to age.

Parents

0 Duke over 12 years ago

Hi Christian -
The concept and technical details to monitor Launch Agent folders was published by Topher Kessler on cnet.com:
http://reviews.cnet.com/8301-13727_7-57415311-263/monitor-os-x-launchagents-folders-to-help-prevent-malware-attacks/
and turned into an app that anyone can download and run:
http://www.circl.lu/pub/tr-08/
By using the application, you don't need to know how to create an Appplescript to take advantage of the technique. As pointed out in Kessler's article, "While malware scanners can detect threats once definitions for them are available, you can monitor or lock your systems' launch agents folders to more proactively prevent attacks on your system".
:1009790
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Duke over 12 years ago

Hi Christian -
The concept and technical details to monitor Launch Agent folders was published by Topher Kessler on cnet.com:
http://reviews.cnet.com/8301-13727_7-57415311-263/monitor-os-x-launchagents-folders-to-help-prevent-malware-attacks/
and turned into an app that anyone can download and run:
http://www.circl.lu/pub/tr-08/
By using the application, you don't need to know how to create an Appplescript to take advantage of the technique. As pointed out in Kessler's article, "While malware scanners can detect threats once definitions for them are available, you can monitor or lock your systems' launch agents folders to more proactively prevent attacks on your system".
:1009790
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data