Possible way of clearing the QM remotely using SEC and restoring moved files

HI All,

This might help clear the QM remotely if you don't have an easy way to run scripts on multiple computers.  I haven't tested it on mass though.

1. Download and install AutoIt (http://www.autoitscript.com/site/autoit/)
2. Paste the below in as a new script and save it as setup.au3 for example

RunWait(@ComSpec & " /c " & 'net stop SAVService', "", @SW_HIDE) 

$FilePath = "C:\ProgramData\Sophos\Sophos Anti-Virus\Config\quarantine.xml"
$FilePath2 = "C:\docuemnts and settings\all users\application data\Sophos\Sophos Anti-Virus\Config\quarantine.xml"

If FileExists ($FilePath) Then 
   FileDelete($FilePath)
endIf

If FileExists ($FilePath2) Then 
   FileDelete($FilePath2)
endIf

RunWait(@ComSpec & " /c " & 'net start SAVService', "", @SW_HIDE)

1. In the start menu there is an option: "Compile Script to .exe (x86)", choose that
2. In the application, choose setup.au3, create an exe called setup.exe
3. Place this into the CID in place of the original setup.exe, rename the actual setup.exe to seup.exe.orig.  E.g.

C:\ProgramData\Sophos\Update Manager\Update Manager\CIDs\S000\SAVSCFXP\setup.exe

aka
\\[SECSERVER]\SophosUpdate\CIDs\S000\SAVSCFXP\setup.exe

1. In SEC filter to a list of computers affected by the FP, for example using the column sort on the "Alert and Errors Details" tab.
2. Select all and run a protect, this will run this "custom" setup on the machines to stop the savservice, delete the quarantine.xml and then start the service again.  
3. Run a scan from SEC on these machines to put back what was already in the QM that wasn't part of this FP.
4. Revert the original setup.exe in the CID

As I say, I haven't tested it beyond one computer but it might help.  Feedback welcome.

Regards,

Jak

EDIT,  You could also use a similar method to mass deploy the vbscript here:

http://sophserv.sophos.com/repo_kb/118315/file/QuarRestore.txt

to move back files moved.  To build a setup.exe to run the vbscript....

1. Run: IEXPRESS.EXE
2. Click Next
3. Click Next
4. Call It SophosFIx For example
5. Click Next
6. Click Next
7. Add the QuarRestore.vbs then click Next
8. In the Install Program put: 
   cscript.exe QuarRestore.vbs
9. Click Next
10. Choose Hidden
11. Click Next
12. Enter Setup.exe as the path
13. Tick "Hide File Extracting Progress...."
14. Click Next
15. Set "No restart"
16. Click Next
17. Click Next
18. Click Next
19. Click Finish
20. Locate the setup.exe.

EDIT, it seems that this packaing method throws an error when SEC creates the job to run it, presumably becuase it doesn't like the switches passed to it. by SEC  Ohh well, maybe this is of use if you find it easier to deploy and exe.  Maybe Google vbs to exe to perform the same task.