This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cryptoguard keeps detecting the same Priority (ERP) process as malicious

Hi

We are facing a problem with Cryptoguard that keeps marking a Priority (ERP) files encryption process as Crypto. The first time it happened, I've clicked on 'Mark as Resolved' and that should stop it from recognizing that as Crypto. But, this is not what happened actually. Cryptoguard did that again. I've also excluded the whole Priority installation folder but that also didn't help. I need your assistance, please.

Here are some pictures

Thanks

This thread was automatically locked due to age.

0 Shweta over 5 years ago

Hi Moshe Grinberg

These detections may require a number of actions, please check this article and verify the steps listed. If the process is being excluded then it should be locked until the Alert is acknowledged.

Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 Moshe Grinberg over 5 years ago in reply to Shweta

Hi Shweta

This is what we were doing, you can see that in the pictures attached.. I wouldn't open a thread before checking your knowledge base.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jasmin over 5 years ago in reply to Moshe Grinberg

Hi Moshe Grinberg

I'd like to know that when these alerts are being popped up, are you doing priority installation from the remote the computer to this computer?

As you have mentioned that the software is of ERP encryption software, there is a possibility that Sophos is detecting as false positive.

Regards,

Jasmin
Community Support Engineer | Sophos Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link
Cancel
Vote Up 0 Vote Down

Cancel
0 Moshe Grinberg over 5 years ago in reply to Jasmin

Hi Jasmin This happens every time that employees working on Priority running some Priority process through a terminal. Yes, it's false positive but it keeps recognizing that although we've marked that as resolved which should prevent this from happening again but it's not what actually happening..
Cancel
Vote Up 0 Vote Down

Cancel
0 Jasmin over 5 years ago in reply to Moshe Grinberg

Hi Moshe Grinberg

I'd like to know what happens when he is directly accessing the server without the terminal server and work on that Priority software. Is it detects ransomware attack the same time as well?

Also, marked as resolved doesn't exclude the process permanently but it just unblocks the process immediately. Please refer this article as well for your reference.

Regards,

Jasmin
Community Support Engineer | Sophos Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link
Cancel
Vote Up 0 Vote Down

Cancel