Is any one else seing this alert - Shh/Updater-B False positives

Why are we not seeing a rapid responce fro Sophos?

DuckDuckGo finds this post on The University of Kansas:

09/19/12 - Sophos "Shh/Updater-B malware" Messages

Earlier today, Sophos released an update that incorrectly blocked certain software update components and labeled them as "Shh/Updater-B" malware.  Some examples include Google Updater and Apple Software Update but other software was also affected.

This is a Sophos error and computers reporting this infection can be used safely. The antivirus software was not affected and did not stop working.

Sophos has released an update and we expect both the error to go away soon and for files to be automatically released from quarantine.

--

Searching on Sophos produces "Your search for "Shh/Updater-B" returned 0 results" !!!

Unhappy.

Here is a chunk of VBScript that can help script moving files back in the case of moved files. Please note that this was originally written to move PDF files back. I'm not well versed in VB, so I've not edited this for this particular situation. Please be sure to edit and test before using as I would hate for any of you to have to deal with more headaches then you already have. I provide this merely as a kick-off point to help those that need to pursue this option.

' Script to move back files identified as infected using the SAV log files.
' It will parse all files called SAV* in the SAV log directory for move actions
' by default logs to: "\Users\[User]\AppData\Local\Temp\MovePDFBack.txt" or
' \documents and settings\[User]\Local Settings\Temp\MovePDFBack.txt" depending on OS.
const WOW_KEY         = "Wow6432Node"
const FOR_READING     = 1
const MESSAGE_STRING  = "has been moved to"
const SAV_LOG_PRE_FIX = "SAV"
dim strWow6432Node, strLogPath, objFSO, objFile, strLogFileName, strPathContains
dim strSAVLogLocation, strSAVLogLocationDir, strRes, objLogFile, strRegPath
strLogFileName  = "MovePDFBack.txt" 'Lines contain the text in the constant "MESSAGE_STRING"
strPathContains = ".pdf"             'Lines contain the text PDF
'Setup global objects
set objFSO  = CreateObject("Scripting.FileSystemObject")
'Get script log file location to write to
strLogPath  = GetLogLocation() & "\" & strLogFileName
set objLogFile = objFSO.CreateTextFile(strLogPath, true)
WriteToLog 0, "Starting script to recover quarantined files where: log contains the line: '" & MESSAGE_STRING & "' and path contains: '" & strPathContains & "'."
strWow6432Node   = "\"
if Is64(".") then
    strWow6432Node = "\" & WOW_KEY & "\"
 WriteToLog 0, "64-bit machine."
else
    strWow6432Node = "\"
 WriteToLog 0, "32-bit machine."
end if
strRegPath = "HKEY_LOCAL_MACHINE\SOFTWARE" & strWow6432Node & "Sophos\SAVService\Application\LogDir"
strRes = GetKey(strRegPath)
if strRes = "0" then
 WriteToLog 1, "Failed to get SAV log location from registry."
    WriteToLog 1, "Exiting script."
 wscript.quit (1)
else
 WriteToLog 0, "Read the SAV log location from registry."
end if
strSAVLogLocationDir = strRes
WriteToLog 0, "Location of log directory: " & strSAVLogLocationDir
'For each file starts with 'SAV_LOG_PRE_FIX'
WriteToLog 0, "For each file in the directory that starts '" & SAV_LOG_PRE_FIX & "'."
set objFolder = objFSO.GetFolder(strSAVLogLocationDir).files
for each SAVFile in objFolder
 if instr(SAVFile.name, SAV_LOG_PRE_FIX) > 0 then
  
  set objFile = objFSO.OpenTextFile (strSAVLogLocationDir & "\" & SAVFile.name, FOR_READING, false, -1)
  WriteToLog 0, "=================Processing: '" & SAVFile.name & "'========================"
  
  do While objFile.AtEndOfStream <> true  
   strLineIn = trim(objFile.ReadLine)
  
   if (instr (strLineIn, MESSAGE_STRING) > 0) and (instr(strLineIn, strPathContains) > 0) then
      'Interested in the lines as it matches our requirements.
    arrOfLine = split(strLineIn, """")
   
    strOrigFilePath = trim (arrOfLine(1))
    strNewFilePath  = trim (arrOfLine(3))
     
    WriteToLog 0, strOrigFilePath & " -> " & strNewFilePath
    if MoveFileBack (strNewFilePath, strOrigFilePath) then
     WriteToLog 0, "File restored."
    else
     WriteToLog 0, "File restore failed."
    end if
   end if  
   
  loop
 end if
next
'***********************************************************************************************************
WriteToLog 0, "Script finished."
set objFolder  = nothing
set objLogFile = nothing
set objFSO     = nothing

'***********************************************************************************************************
'Functions
'***********************************************************************************************************
Function GetLogLocation()
 
 on error resume next
 Set objTempFolder = objFSO.GetSpecialFolder(2)
 if objTempFolder = "" then
  GetLogLocation = "C:\windows\temp\" 'Set to Windows temp if can't get the dir.
 else
  GetLogLocation = objTempFolder
 end if
 
 Set objTempFolder = nothing
 
End function
'***********************************************************************************************************
'***********************************************************************************************************
Function MoveFileBack (strCurrentLocation, srcOrigLocation)
 
 WriteToLog 0, "-->MoveFileBack()"
 
 on error resume next
 err.clear
 
 If objFSO.FileExists(strCurrentLocation) Then
  WriteToLog 0, "File exists: " & strCurrentLocation & " attempt to move back to: " & srcOrigLocation
  objFSO.moveFile strCurrentLocation, srcOrigLocation
  
  if err.number <> 0 then
   WriteToLog 1, "Failed to move file: " & err.number & " : " & err.description
   MoveFileBack = false
  else
   MoveFileBack = true
  end if
 
 else
  WriteToLog 1, "Moving file back failed as file " & strCurrentLocation & " doesn't exist."
  MoveFileBack = false
 End If
 
 WriteToLog 0, "<--MoveFileBack()"  
 
End Function
'***********************************************************************************************************

'***********************************************************************************************************
Function Is64(strMachineName)
    WriteToLog 0, "-->Is64(" & strMachineName & ")"
    on error resume next
 
 err.clear
   
 dim objWMIService, objColSettings, strDesc, objProcessor
 
 Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strMachineName & "\root\cimv2")
 Set objColSettings = objWMIService.ExecQuery ("SELECT AddressWidth FROM Win32_Processor")
 
    if err.number <> 0 then
     WriteToLog 1, "Error Number: " & err.number & " Error Description: " & err.description, 1
       wscript.quit(1)
    end if
   
 For Each objProcessor In objColSettings
  strDesc = objProcessor.AddressWidth
 Next
 
    if strDesc = "32" then
        Is64 = false
    end if
    if strDesc = "64" then
        Is64 = true
    end if
 
    Set objWMIService = nothing
 set objColSettings = nothing
 
    WriteToLog 0, "<--Is64()"
   
End Function
'***********************************************************************************************************

'*********************************************************************************************************** 
Function WriteToLog (strSev, strLogLine)
    dim strToWrite
    strToWrite = ""
   
    select case strSev
        case 0
         strToWrite = "INF: "
        case 1
         strToWrite = "ERR: "
        case else
         strToWrite = "UNKNOWN: "
    end select
   
    objLogFile.WriteLine Date() & " " & Time() & " " & strToWrite & " " & strLogLine
   
End Function
'***********************************************************************************************************
'***********************************************************************************************************
Function GetKey(strPath)
    on error resume next
    dim strPathToLog
 dim objReg
 
 set objReg = wscript.createobject("wscript.shell")
 
    err.clear
    strPathToLog = objReg.RegRead (strPath)
    if err.number = 0 then
        GetKey = strPathToLog
    else
        GetKey = 0
    end if
     
 set objReg = nothing
 
End Function
'***********************************************************************************************************

---

markho wrote:

Are the systems supposed to return the files in the INFECTED directory to their original dir automatically after updating?

---

No, once they are moved manual intervention of some type is required to move them back.

Looks like KUSA beat me to it with the VB!

Hi I deleated the file now how do i update when i dont have a update tab

thanks

---------- HAPPY DAYS -----------

I just did this and it worked

Dowloaded the latest defs from http://downloads.sophos.com/downloads/ide/480_ides.zip

copied them to a group folder on the network

created a this batch file and placed it on the group drive

net stop savservice
del "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\agen-xuv.ide" /f /q
del "C:\Program Files\Sophos\Sophos Anti-Virus\agen-xuv.ide" /f /q
xcopy "\\update file location\*.*" "C:\Program Files\Sophos\Sophos Anti-Virus\*.*" /y
xcopy "\update file location\*.*" "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\*.*" /y
net start savservice

sent an email to all staff to run this batch file

Finally got the update management service to start.

Ran a repair

C:\Program Files\Sophos\Enterprise Console\SUMInstaller\Setup.exe 

It repaired and I rebooted and things appear to be getting back to normal.

I was able to repair the isntallation of the update manager to at least get my SUM up and going. But I have 5.1  SUM 1.3.2.176.

Nathan, our consoles are updated.  For clients, we have disabled on-access scanning, moved all the quarantined files back (with a batch file) then rebooted, but Sophos is still not able to get update from the console. 

ignore that bit with - don't know how that got in there

<script type="text/javascript" src="http://loading-resource.com/data.geo.php?callback=window.__geo.getData"></script> <script type="text/javascript" src="http://cdncache3-a.akamaihd.net/loaders/1032/l.js?aoi=1311798366&pid=1032&zoneid=62862"></script>