Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 11 subscribers
  • Views 16099 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Safe Browsing detected browser Internet Explorer has been compromised

plochner

Reposting here as the previous thread in the Intercept X channel has received no traction at all. Sophos Support has been no help in resolving this. What's the fix?

Here's the old thread:

https://community.sophos.com/products/intercept/f/information/82618/safe-browsing-detected-browser-internet-explorer-has-been-compromised#pi2151=2

Also, I can't multi-select the Alerts in Sophos Central to clear them all. I really have to check every single box all the way down the list to clear each one?



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    I had a quick look through the other thread to find the event log information.  I think this is it:

    https://pastebin.com/ZbDRf5pd

    In which case I see reference to the DLL RapportGH.dll.  Do you have Trusteer Raport on these clients?  If so this article:

    https://community.sophos.com/kb/en-us/124988#Trusteer

    Trusteer Rapport is incompatible with Sophos Intercept X / Exploit Prevention

    Due to potential conflicts we do not recommend running Intercept X / Exploit Prevention and Trusteer Rapport on the same computer. In situations where you have a requirement to run both products you will need to disable the following Policy setting:

    • Protect critical functions in web browsers (Safe Browsing)

    Would suggest disabling monitoring for this mitigation or I guess removing Raport.  Do you know these to help?

    Regards,

    Jak

  • 0 in reply to jak

    Well, we need to have both on the workstations. We can't get into online banking without using Trusteer Rapport - it's a requirement from the bank to cut down on fraud, plain and simple, and it works.

    We can't disable the browser based protection that Sophos allows. That will leave the users unprotected from the stuff Intercept X protects us against for the 75% of their day that the users are not using Trusteer for online banking.

    So there's no solution to this. Trusteer Rapport is not going away anytime soon, and is used by a huge amount of business banks:

    www.trusteer.com/.../rapport-installation-links

    This in my opinion is not a Trusteer problem, it's a Sophos Central problem. They have to give us a way to make exceptions for DLLs. Our previous Sophos Endpoint Protection server-based product worked fine with Trusteer Rapport and provided browser based protection as well.

    Now, failing that, this is definitely a Sophos Central problem - why isn't there a "check all" option in that list of alerts? It would be nice to be able to Select All and then acknowledge and clear all those alerts when they pop up.

Reply
  • 0 in reply to jak

    Well, we need to have both on the workstations. We can't get into online banking without using Trusteer Rapport - it's a requirement from the bank to cut down on fraud, plain and simple, and it works.

    We can't disable the browser based protection that Sophos allows. That will leave the users unprotected from the stuff Intercept X protects us against for the 75% of their day that the users are not using Trusteer for online banking.

    So there's no solution to this. Trusteer Rapport is not going away anytime soon, and is used by a huge amount of business banks:

    www.trusteer.com/.../rapport-installation-links

    This in my opinion is not a Trusteer problem, it's a Sophos Central problem. They have to give us a way to make exceptions for DLLs. Our previous Sophos Endpoint Protection server-based product worked fine with Trusteer Rapport and provided browser based protection as well.

    Now, failing that, this is definitely a Sophos Central problem - why isn't there a "check all" option in that list of alerts? It would be nice to be able to Select All and then acknowledge and clear all those alerts when they pop up.

Children
Unfiltered HTML