Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 1 subscriber
  • Views 13260 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Unable to authorize application

Michael_Mc

Hi - I use a Teacher/Tutor application here called AB Tutor. It monitors the client and allows the teacher to view/control the student PC. The client often gets updated and Sophos generally picks it up as an unathorized application. However I can't get the clients (S10 on XPSP3) to allow the application today. It won't do it remotely from SEC (4.5.0.9 on Server2003) either. I have always added the client exe to the Authorization Manager (it's listed multiple times within "Suspicious Behaviour" and I've always added all ABClient.exe to the allowed applications side) I'm also receiving Event Decode Unavailable on the same clients too (about 20 clients) Really annoying! Anyone any ideas please?

:24713


This thread was automatically locked due to age.
  • 0

    Hello Michael,

    as for Event Decode Unavailable - what is the undecoded error you receive?

    I can't get the clients to allow the application

    You mean you add it to the Authorized list but it is still detected? What's the name of the detection(s), eg. SUS/ (note that it might trigger in different categories)

    it's listed multiple times

    These are specific instances (versions) of the program in question. If you hover the mouse over an entry you'll see the details.

    Sending in the application for analysis is an option. Under certain circumstances it is possible to get an application "white listed".

    Christian 

    :24715
  • 0

    Thanks for the reply Christian.

    I've just upgrade SEC to 5.0.0.8 to see if that would help! The Event Decode Unavailable now has a better error on the same faulty clients- and not so generic! It's now reporting a058000c "Web protection is no longer functional. The filtering driver has been bypassed or unloaded"

    I've added the client (ABClient.exe) to the Authorized Behaviour - Authorized applications. Each client appears there (with the version number as you rightly point out)

    It's detected with the HIPS/RegMod-009 engine.

    If I try and allow the client locally (Log onto one of the PC's in question - Launch S and then Quarantine - Authorise. It fails. Very quickly "Authorise failed". Can't see anything in the log refering to the authorise, just the detection of it.

    Thanks again for your help

    Michael

    :24721
  • 0

    Hello Michael,

    the error could be related to the application (Enterprise Console reports error a058000c) and it might go together with a HIPS/RegMod-009 detection.

    Can't say where the failure would be logged if at all. I suggest you contact Support

    Christian

    :24723
  • 0
    I've just spoken to support and the issue with my clients reporting issues with web protection is an issue with the Web Protection and what it attempts to insert into winsock. This conflicts with the transparent ISA server I have and therefore produces this error. Sophos are very aware of this issue and it's to be fixed in an upcoming release (He thinks August with v10.6). Temp fix is to disable WP within EC and roll out the policy change (reboot needed on clients). Great to know it's not just me and Sophos are aware of the problem.
    :24851