Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 1 subscriber
  • Views 13261 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Unable to authorize application

Michael_Mc

Hi - I use a Teacher/Tutor application here called AB Tutor. It monitors the client and allows the teacher to view/control the student PC. The client often gets updated and Sophos generally picks it up as an unathorized application. However I can't get the clients (S10 on XPSP3) to allow the application today. It won't do it remotely from SEC (4.5.0.9 on Server2003) either. I have always added the client exe to the Authorization Manager (it's listed multiple times within "Suspicious Behaviour" and I've always added all ABClient.exe to the allowed applications side) I'm also receiving Event Decode Unavailable on the same clients too (about 20 clients) Really annoying! Anyone any ideas please?

:24713


This thread was automatically locked due to age.
Parents
  • 0

    Thanks for the reply Christian.

    I've just upgrade SEC to 5.0.0.8 to see if that would help! The Event Decode Unavailable now has a better error on the same faulty clients- and not so generic! It's now reporting a058000c "Web protection is no longer functional. The filtering driver has been bypassed or unloaded"

    I've added the client (ABClient.exe) to the Authorized Behaviour - Authorized applications. Each client appears there (with the version number as you rightly point out)

    It's detected with the HIPS/RegMod-009 engine.

    If I try and allow the client locally (Log onto one of the PC's in question - Launch S and then Quarantine - Authorise. It fails. Very quickly "Authorise failed". Can't see anything in the log refering to the authorise, just the detection of it.

    Thanks again for your help

    Michael

    :24721
Reply
  • 0

    Thanks for the reply Christian.

    I've just upgrade SEC to 5.0.0.8 to see if that would help! The Event Decode Unavailable now has a better error on the same faulty clients- and not so generic! It's now reporting a058000c "Web protection is no longer functional. The filtering driver has been bypassed or unloaded"

    I've added the client (ABClient.exe) to the Authorized Behaviour - Authorized applications. Each client appears there (with the version number as you rightly point out)

    It's detected with the HIPS/RegMod-009 engine.

    If I try and allow the client locally (Log onto one of the PC's in question - Launch S and then Quarantine - Authorise. It fails. Very quickly "Authorise failed". Can't see anything in the log refering to the authorise, just the detection of it.

    Thanks again for your help

    Michael

    :24721
Children
No Data