Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1178 replies
  • Subscribers 1 subscriber
  • Views 3261225 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Is any one else seing this alert - Shh/Updater-B False positives

leftout

Virus/spyware 'Shh/Updater-B' has been detected in "C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_update.exe". Cleanup unavailable. This is trickling in as alerts but at an alarming rate.

:29723


This thread was automatically locked due to age.
Parents
  • 0

    My script for what its worth.....we had Sophos set to delete files.

    IF EXIST "c:\SophosFix\AUFiles\ALMon.exe" GOTO END

    Net Stop "SAVService"
    net stop "Sophos AutoUpdate Service"
    net stop "Sophos Agent"
    net stop "SAVAdminService"
    net stop "Sophos Device Control Service"
    net stop "Sophos Message Router"
    net stop "Sophos Web Control Service"

    If Exist "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\agen-xuv.ide" (Del "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\agen-xuv.ide"&Echo File Deleted)

    If Exist "C:\Program Files\Sophos\Sophos Anti-Virus\agen-xuv.ide" (Del "C:\Program Files\Sophos\Sophos Anti-Virus\agen-xuv.ide"&Echo File Deleted)


    xcopy "\\server\SophosUpdate\CIDs\S000\SAVSCFXP\SAU\program files\Sophos\AutoUpdate\*.*" "c:\SophosFix\AUFiles\" /y


    If Exist "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\savmain.exe" (Copy "c:\SophosFix\AUFiles\*.*" "C:\Program Files (x86)\Sophos\AutoUpdate"&Echo File Deleted)

    If Exist "C:\Program Files\Sophos\Sophos Anti-Virus\savmain.exe" (Copy "c:\SophosFix\AUFiles\*.*" "C:\Program Files\Sophos\AutoUpdate"&Echo File Deleted)

    Del "C:\ProgramData\Application Data\Sophos\Sophos Anti-Virus\config\Quarantine.xml"
    Del "C:\Documents and Settings\All Users\Application Data\Sophos\Sophos Anti-Virus\config\Quarantine.xml"

    net start "Sophos AutoUpdate Service"
    Net Start SAVService
    net start "Sophos Agent"
    net start "SAVAdminService"
    net start "Sophos Device Control Service"
    net start "Sophos Message Router"
    net start "Sophos Web Control Service"

    :END

    :31659
Reply
  • 0

    My script for what its worth.....we had Sophos set to delete files.

    IF EXIST "c:\SophosFix\AUFiles\ALMon.exe" GOTO END

    Net Stop "SAVService"
    net stop "Sophos AutoUpdate Service"
    net stop "Sophos Agent"
    net stop "SAVAdminService"
    net stop "Sophos Device Control Service"
    net stop "Sophos Message Router"
    net stop "Sophos Web Control Service"

    If Exist "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\agen-xuv.ide" (Del "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\agen-xuv.ide"&Echo File Deleted)

    If Exist "C:\Program Files\Sophos\Sophos Anti-Virus\agen-xuv.ide" (Del "C:\Program Files\Sophos\Sophos Anti-Virus\agen-xuv.ide"&Echo File Deleted)


    xcopy "\\server\SophosUpdate\CIDs\S000\SAVSCFXP\SAU\program files\Sophos\AutoUpdate\*.*" "c:\SophosFix\AUFiles\" /y


    If Exist "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\savmain.exe" (Copy "c:\SophosFix\AUFiles\*.*" "C:\Program Files (x86)\Sophos\AutoUpdate"&Echo File Deleted)

    If Exist "C:\Program Files\Sophos\Sophos Anti-Virus\savmain.exe" (Copy "c:\SophosFix\AUFiles\*.*" "C:\Program Files\Sophos\AutoUpdate"&Echo File Deleted)

    Del "C:\ProgramData\Application Data\Sophos\Sophos Anti-Virus\config\Quarantine.xml"
    Del "C:\Documents and Settings\All Users\Application Data\Sophos\Sophos Anti-Virus\config\Quarantine.xml"

    net start "Sophos AutoUpdate Service"
    Net Start SAVService
    net start "Sophos Agent"
    net start "SAVAdminService"
    net start "Sophos Device Control Service"
    net start "Sophos Message Router"
    net start "Sophos Web Control Service"

    :END

    :31659
Children
No Data