Is any one else seing this alert - Shh/Updater-B False positives

Just some notes on my experiences so far. 

In my Sophos Control Center I, unfortunately, had my on-access scanning cleanup option set to deny access and move to default location.  When the cluster f of an update occurred earlier, it threw a bunch of Sophos Auto Update files as well as some other update files into this location:

C:\ProgramData\Sophos\Sophos Anti-Virus\INFECTED

Fortunately, as Nathan mentioned a few times in this thread, the log file takes note of the original file path of all files moved.  Log file is located here:

C:\ProgramData\Sophos\Sophos Anti-Virus\logs\sav.txt

I'm not a programmer and it would probably take me longer to figure out a script to automate this so I manually moved the files back to their original directories having to remove the .000 at the end of each file that Sophos adds when it moves the files.

My workstation is back up and running (and up to date) without any erros so at least Sophos quickly corrected the problem.

I manage only about 10 users so I guess I'll be spending some time manually moving these files unless someone has a better solution.

I feel very badly for all you enterprise admins out there that have off-site and large numbers of workstations to correct (unless you were smarter than I was to begin with and just denied access for cleanup). I've now changed that setting... :)

Good luck all! 

Just some notes on my experiences so far. 

In my Sophos Control Center I, unfortunately, had my on-access scanning cleanup option set to deny access and move to default location.  When the cluster f of an update occurred earlier, it threw a bunch of Sophos Auto Update files as well as some other update files into this location:

C:\ProgramData\Sophos\Sophos Anti-Virus\INFECTED

Fortunately, as Nathan mentioned a few times in this thread, the log file takes note of the original file path of all files moved.  Log file is located here:

C:\ProgramData\Sophos\Sophos Anti-Virus\logs\sav.txt

I'm not a programmer and it would probably take me longer to figure out a script to automate this so I manually moved the files back to their original directories having to remove the .000 at the end of each file that Sophos adds when it moves the files.

My workstation is back up and running (and up to date) without any erros so at least Sophos quickly corrected the problem.

I manage only about 10 users so I guess I'll be spending some time manually moving these files unless someone has a better solution.

I feel very badly for all you enterprise admins out there that have off-site and large numbers of workstations to correct (unless you were smarter than I was to begin with and just denied access for cleanup). I've now changed that setting... :)

Good luck all!