Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 1 subscriber
  • Views 5877 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos quarantining auto update again

bestseany

Has anybody noticed that Sophos is quarantining its own update program again?

We noticed that the clients were failing to update this morning and that alsvc.exe is quarantined on the clients. We had this a few months back when it was a known problem but I can't find anything about it today.

:38379


This thread was automatically locked due to age.
  • 0

    Hello bestseany,

    what was the detection reported? And did it affect alsvc.exe only?

    Christian

    :38381
  • 0

    Yes, the alsvc.exe file was the only one affected.

    It was reporting it as Shh/Updater-B. I've tried adding the file has an exception in the AV policy but it doesn't help.

    We're using Enterprise 5.1 and version 10 of the client.

    :38383
  • 0

    Hello bestseany,

    don't think the FP has risen from the grave :smileysurprised:

    What are your cleanup settings? Have the files been moved or deleted? If not, the updating should work when you add the exclusion (you specified the file name, didnt you?) and the clients comply.

    In addition to the clients' VDL version and IDE count you should check the date of the detection. Unlikely that some clients have updated and reported for half a year but I won't rule it out absolutely. I would have suggested collecting the logs and sending them to support, but then you probably want to make sure that it is not a false alarm (forgive the pun).

    Christian

    :38385
  • 0

    The cleanup settings are set to Deny Only. Nothing's being done to the file, it's just being kept in quarantine. This is actually every machine on the network (nearly 200) now and nothing has updated since yesterday morning.

    The exception has been added but it doesn't help. I tried reinstalling Sophos on one client, the file isn't showing as quarantined but it still won't update.

    There's definitely something wrong that wasn't wrong before. I guess I'll have to speak to Sophos support.

    :38411