Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 4 replies
  • Answers 2 answers
  • Subscribers 11 subscribers
  • Views 2895 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ROP exploit prevented

fnanfne

Hi 

I have the same issue as the users in this thread.

https://community.sophos.com/community-chat/f/discussions/108211/rop-exploit-prevented-in-microsoft

Our users are trying to use a VoIP tool called VoIPOffice Communicator and Sophos is blocking them, we've been using this application for years now and the flag is a false positive for sure.

All the links provided for a workaround in the above URL is null and void.

I have added FOUR exclusions to Sophos Central now, but this is still being blocked.

Please help.

Thanks
Steven



This thread was automatically locked due to age.
Parents
  • 0

    Hi fnanfne,

    Thanks for reaching out to the Sophos Community Forum.

    If you see unexpected detections come up on a device, I suggest trying to install the Intercept X Hotfix Package. 

    If this also does not work, you may want to try using steps under "Stop checking for a specific exploit on an application". If you can look into the Windows Event Viewer to share the output from "Event ID 911" this will also provide more context on why the detection is being generated. The same information can also be found by clicking the "Details" button on the detection event from Sophos Central.

    Sometimes this can be due to add-ons or 3'd party applications that interact with your Office apps.

Reply
  • 0

    Hi fnanfne,

    Thanks for reaching out to the Sophos Community Forum.

    If you see unexpected detections come up on a device, I suggest trying to install the Intercept X Hotfix Package. 

    If this also does not work, you may want to try using steps under "Stop checking for a specific exploit on an application". If you can look into the Windows Event Viewer to share the output from "Event ID 911" this will also provide more context on why the detection is being generated. The same information can also be found by clicking the "Details" button on the detection event from Sophos Central.

    Sometimes this can be due to add-ons or 3'd party applications that interact with your Office apps.

Children
No Data
Unfiltered HTML
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?