Malware or potentially unwanted applications in quarantine Status

Hi Maurice,

The infected files are moved to C:\ProgramData\Sophos\Sophos Anti-Virus\INFECTED by default unless the directory is changed. Let me know if this helps resolve your issue.

Haridoss,

Thanks for your response, but it's not very helpful. That folder location doesn't have anything in it. I'm assuming by your response there isn't a Quarantine folder anymore? The only way around this I have found it to completely uninstall/reinstall Sophos AV to make the workstation has the green indication in Sophos Central. There MUST be a better way. This is a deal breaker and would make us consider switching providers when our licensing expires in January. 

Haridoss, 

Can you please follow up on this? This is super frustrating and preventing my logs from being compliant for security checks. The LOG folder you suggested is blank, however these workstations still show out of compliance. 

We'll be more than likely switching AV providers in January. 

Do you have the details of the detection from Central that caused this outstanding alert?  Presumably in the Event history for the computer in Central there was an event such as:

Malware detected: 'EICAR-AV-Test' at 'C:\Users\user1\Desktop\test.zip'

As a result, at the endpoint, in the Client UI, there is an "Open" event in the Events list such as:



This is mirrored in Central as:

In the case of malware in an archive, which is what we have in this example (I just put the Eicar string in a .txt file, zipped it up and right-click scanned it); Sophos will not delete the zip as there could be a file in the archive that you want.  So this is a bit of a special case as there is no cleanup routine to unpack, remove parts of the archive and re-create the archive.  

Note: There is no danger of the file executing as it would need to be unpacked and run at which point the on-access scanner would do its job.

In this case, if I delete the file from disk and start a scan, once complete the state then becomes:



At this point a message is sent to Central to confirm the health is good.

Under: C:\ProgramData\Sophos\Health\Event Store\Trail\ (in this case SAV-[GUID]) I see the "events.sav.threat.created" event for this detection and then the "events.sav.threat.cleared" event.  These make up the details in the UI.

It's for this reason the alert that caused the event is probably significant. Do you know what the alerts were on these clients that caused the event?

Regards,
Jak

Thanks for responding.  Two examples

1) One computer X, these events triggered back in June that the Device, Data Loss Prevention, Tamper Control, Application Control and Malware Protection wasn't running. 

2). This computer has a PUA that we've approved and made and exception for, but it keeps triggering. I cannot get it to clear. 

For the second case, I.e. an alert for the PUA: "Generic PUA LF". If you are happy to authorize this PUA, then "Globally" under https://cloud.sophos.com/manage/endpoint/config/settings/scanning-exclusions (applies to all computers) you should be able to set:





After clicking Save, within 20 seconds, the file "C:\ProgramData\Sophos\Sophos Anti-Virus\Config\machine.xml" on the endpoint should be updated.  The significant part of the file here is:

<quarantineManager>
....
<authorisedList policy="0"><item>Generic PUA LF</item></authorisedList>
<authorisedFileList policy="0" xml:space="preserve"/>
</quarantineManager>

Note: This PUA has spaces in the name, which need to be kept.

You could check if the computers have this value in machine.xml.  Note: you will probably have to copy and paste it to say the desktop to open it.

For the other alert, these are just policy compliance which I would imagine are transitory and should be fixed.

"C:\Program Files\Sophos\Endpoint Self Help\SophosDiag.exe" might worth a run to check that:

1. The client is communicating OK with Central.
2. The policy times look good.  
3. Worth checking that on the System page, the Endpoint ID value aligns with the computer you are looking at in Central. The URL has this same GUID in it, e.g. cloud.sophos.com/.../summary

For reference the cached policy files live here on the endpoint: "C:\ProgramData\Sophos\Remote Management System\3\Agent\AdapterStorage\".  You can see each component has a sub-directory.  All the ones in the screenshot you provided belong to the SAV component so would be under: "C:\ProgramData\Sophos\Remote Management System\3\Agent\AdapterStorage\SAV\".

Regards,
Jak

P.S. I updated my previous post with a little more info.

Thanks for the feedback. I still cannot get the ones with for the "Malware or potentially unwanted applications in quarantine" to clear, even after removing the files and re-scanning the computer. 

So the endpoint is in the state now, where if you look at the Events list in the local UI, you have an alert with a yellow triangle, I.e., an entry that isn't cleaned up, something is still outstanding.

However the file is no longer on disk in the location referenced as you have manually removed it.

Did you initiate the scan from Central or from the Endpoint UI?  If you used Central, can you try clicking "Scan" on the "Status" page at the client?

I assume that at the client, the health state:
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\Health\Status 
"health" = 2 as the "threat" value is 2.

And under:
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SavService\ThreatLifetime

if you drill down, I assume you have this open threat.

Once SAV "cleans" up then this entry under the Threats sub-key for the alert should be gone and under the trail of events:

C:\ProgramData\Sophos\Health\Event Store\Trail\

where you have a corresponding SAV-GUID-.json file for the threat (with a state of "events.sav.threat.created"), there should be one create for the cleanup (events.sav.threat.cleared).

I assume that when the threat is cleaned up, SAV drops a JSON file into C:\ProgramData\Sophos\Health\Event Store\Incoming\ which is processed.

Regards,

Jak

I have the same situation and NOTHING in this thread help me. Have any solution?

I have this exact same issue.  Some PUA's that I allow are forever triggered.  I can't get Sophos to ignore them.  I even have the location excluded in the Global Scanning Exclusions and it still scans that location.

Hi,

as far as i remember it is possible to delete the events.db on the specific client.
(Somewhere under programdata)
After that the state goes back to green.

Perhaps someone could reply with the exact steps, beacause at the moment we have no errors at our customers :)

Hi,

as far as i remember it is possible to delete the events.db on the specific client.
(Somewhere under programdata)
After that the state goes back to green.

Perhaps someone could reply with the exact steps, beacause at the moment we have no errors at our customers :)