Is any one else seing this alert - Shh/Updater-B False positives

---

Nik_Nak2 wrote:

If anyone hasn't tried the below already give it a try - thankfully I had a back up.

The Shh/Updater B deleted some files and then I couldn't get the update files working.

1) Remove agen-xuv.ide from "C:\Program Files\Sophos\Sophos Anti-Virus"

2) Disable on access scanning in Sophos control centre

3) Under Anti-Virus Hips in the "Endpoint Security" module add - the aforementioned exceptions:

C:\Documents and Settings\All Users\Application Data\Sophos\

C:\Program Files\Sophos\

C:\Program Files (x86)\Sophos\

C:\programdata\sophos\

4) run "services.msc" from server - Start>Run command

5) Find the following 2 services: Sophos AutoUpdate Service & Sophos Update Manager

6) Right click and select properties and each service and write down the path to the executable files. They should be something like Program files\sophos\auto update & Program files\sophos\scc\sum

7) Locate these folders - these are where there are likely to be files missing! If you have a back up then locate the archived folders - then compare.

I was missing ALUpdate.exe and ALsvc.exe from the suto update folder and SophosUpdateMgr.exe, SUMservice.exe and UpdateSUMConfig.exe from the SUM folder. Providing you have the backups - and have disabled on access scanning you should be able to copy in the missing files.

8) Once you have done this restart the above mentioned services

9) Choose update now from the Sophos Control Center

10) Hey presto that should have fixed it - you may then need to either update all workstations manually or centrally from the server

Good luck

CB

Make sure that your two folders SUM & Sophos Auto Update files have the same files in as before - my sophos deleted a few and I had to go into a backup to get them back!

---

There are many extra steps here that are not required. Please see our advisory for instructions to assist with recovery.

---

Nik_Nak2 wrote:

If anyone hasn't tried the below already give it a try - thankfully I had a back up.

The Shh/Updater B deleted some files and then I couldn't get the update files working.

1) Remove agen-xuv.ide from "C:\Program Files\Sophos\Sophos Anti-Virus"

2) Disable on access scanning in Sophos control centre

3) Under Anti-Virus Hips in the "Endpoint Security" module add - the aforementioned exceptions:

C:\Documents and Settings\All Users\Application Data\Sophos\

C:\Program Files\Sophos\

C:\Program Files (x86)\Sophos\

C:\programdata\sophos\

4) run "services.msc" from server - Start>Run command

5) Find the following 2 services: Sophos AutoUpdate Service & Sophos Update Manager

6) Right click and select properties and each service and write down the path to the executable files. They should be something like Program files\sophos\auto update & Program files\sophos\scc\sum

7) Locate these folders - these are where there are likely to be files missing! If you have a back up then locate the archived folders - then compare.

I was missing ALUpdate.exe and ALsvc.exe from the suto update folder and SophosUpdateMgr.exe, SUMservice.exe and UpdateSUMConfig.exe from the SUM folder. Providing you have the backups - and have disabled on access scanning you should be able to copy in the missing files.

8) Once you have done this restart the above mentioned services

9) Choose update now from the Sophos Control Center

10) Hey presto that should have fixed it - you may then need to either update all workstations manually or centrally from the server

Good luck

CB

Make sure that your two folders SUM & Sophos Auto Update files have the same files in as before - my sophos deleted a few and I had to go into a backup to get them back!

---

There are many extra steps here that are not required. Please see our advisory for instructions to assist with recovery.