This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos blocking google analytics

Hi,

This morning I am getting warnings about google analytics tracker being a high risk website:

****************** Sophos Anti-Virus Log - 10/06/2011 08:23:26 **************
20110610 081843Using detection data version 4.66G (detection engine 3.20.2). This version can detect 2622265 items.

20110610 081843User (NT AUTHORITY\LOCAL SERVICE) has started on-access scanning for this machine.

20110610 081954Blocked web request to "www.google-analytics.com/__utm.gif" for user Ned-VAIO\Ned. 'Mal/HTMLGen-A' has been found at this website, reference ID 264964.

20110610 082006Blocked web request to "www.google-analytics.com/siteopt.js" (linked from "www.sophos.com") for user Ned-VAIO\Ned. 'Mal/HTMLGen-A' has been found at this website, reference ID 264964.

20110610 082014Blocked web request to "www.google-analytics.com/__utm.gif" (linked from "www.sophos.com/support") for user Ned-VAIO\Ned. 'Mal/HTMLGen-A' has been found at this website, reference ID 264964.

20110610 082022Blocked web request to "www.google-analytics.com/__utm.gif" (linked from "www.sophos.com/en-us/Search-Results.aspx") for user Ned-VAIO\Ned. 'Mal/HTMLGen-A' has been found at this website, reference ID 264964.

20110610 082032Blocked web request to "www.google-analytics.com/__utm.gif" (linked from "www.sophos.com/support/knowledgebase/article/110579.html") for user Ned-VAIO\Ned. 'Mal/HTMLGen-A' has been found at this website, reference ID 264964.

20110610 082059Blocked web request to "www.google-analytics.com/__utm.gif" (linked from "www.sophos.com/support/queries") for user Ned-VAIO\Ned. 'Mal/HTMLGen-A' has been found at this website, reference ID 264964.

20110610 082108Blocked web request to "www.google-analytics.com/__utm.gif" (linked from "community.sophos.com") for user Ned-VAIO\Ned. 'Mal/HTMLGen-A' has been found at this website, reference ID 264964.

20110610 082138Blocked web request to "www.google-analytics.com/__utm.gif" (linked from "community.sophos.com/t5/Sophos-Endpoint-Security-and/bd-p/ESDP") for user Ned-VAIO\Ned. 'Mal/HTMLGen-A' has been found at this website, reference ID 264964.

20110610 082214Blocked web request to "www.google-analytics.com/__utm.gif" (linked from "community.sophos.com/t5/forums/postpage/board-id/ESDP") for user Ned-VAIO\Ned. 'Mal/HTMLGen-A' has been found at this website, reference ID 264964.

Is this sophos incorrectly identifying this or google actually sending malware down their analytics?

This thread was automatically locked due to age.

0 RBGE over 14 years ago

Similar issue here - pretty much every site I'm visiting (including community.sophos.com !!) is triggering these alerts - www.google-analytics.com/ga.js in this case.
I'm just awaiting the flood of helpdesk calls from several hundred users about "all these Sophos alerts" now... :smileysad:
:13795
Cancel
Vote Up 0 Vote Down

Cancel
0 auto27 over 14 years ago

Same here... and actually being blocked in the whole company. I've not seen it before...
Now blocking ga.js from google-analytics.com so our visits cannot be tracked by the giant :)
Either google is messing up their ga.js or Sophos needs to update the definition.
:13797
Cancel
Vote Up 0 Vote Down

Cancel
0 DouglasLeeder over 14 years ago

It's a false positive:
http://www.sophos.com/support/knowledgebase/article/113714.html
:13799
Cancel
Vote Up 0 Vote Down

Cancel
0 oxford_nm over 14 years ago

According to http://www.sophos.com/support/knowledgebase/article/113714.html the problem has been solved. But I have updated my anti-virus and I still keep getting virus alerts?
:13801
Cancel
Vote Up 0 Vote Down

Cancel
0 RBGE over 14 years ago

Well, at least I'm getting different alerts - __utm.gif this time :smileyhappy:
I'm fairly confident this will sort itself out pretty soon, and I've only had a couple of people reporting it so far anyway.
At least this false-positive didn't erase system files McAfee style :smileywink:
:13803
Cancel
Vote Up 0 Vote Down

Cancel
0 DouglasLeeder over 14 years ago

There is now a naked-security post on the issue: http://nakedsecurity.sophos.com/2011/06/10/sophos-google-analytics/
It seems to have cleared up on my machine, so I guess the cache has been expired.
:13805
Cancel
Vote Up 0 Vote Down

Cancel
0 Placebo over 14 years ago

For future reverence:
This can not be fixed by updating your anti-virus definitions.
You can fix this by editing your anti-virus and HIPS Policy -> authorization... -> Websites. And add the website there.
:13821
Cancel
Vote Up 0 Vote Down

Cancel