This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Is any one else seing this alert - Shh/Updater-B False positives

Virus/spyware 'Shh/Updater-B' has been detected in "C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_update.exe". Cleanup unavailable. This is trickling in as alerts but at an alarming rate.

This thread was automatically locked due to age.

Parents

0 LINCK over 13 years ago

Hello Sophos

Try to add options to Kill Almon.exe, Alsvc.exe and msiexec.exe process in the .vbs fix.

' FixUpdate.vbs (136, 9) (null) or
' FixUpdate.vbs(135, 26) error
' 
' Change Windows Installer to Manual mode
' ------------------------------------------
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colServiceList = objWMIService.ExecQuery _
("Select * from Win32_Service where Name = 'msiserver'")
For Each objService in colServiceList
   errReturnCode = objService.Change( , , , , "Manual") 
   WScript.echo errReturnCode
Next


' FixUpdate.vbs (136, 9) (null) or
' FixUpdate.vbs(135, 26) error
' 
' Kill all msiexec process
' ------------------------------------------
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcessList = objWMIService.ExecQuery _
("SELECT * FROM Win32_Process WHERE Name = 'msiexec.exe'")
For Each objProcess in colProcessList
   objProcess.Terminate()
Next

Regards

Linck Tello Flores

www.innovare.pe

Reply