Sophos False Positive Warning - what to do

 

Issue

Numerous binaries are falsely detected as Shh/Updater-B.

Cause

An identity released by SophosLabs for use with our Live Protection system is causing False Positives against many binaries that have updating functionality.

Detections of ssh/updater-B made today are false positives and not an outbreak.

If you have Live Protection enabled, you should stop seeing these detections eventually as the files are now marked ‘clean’ in the Live Protection cloud. If you do not have Live Protection enabled you will stop seeing the new detections once javab-jd.ide has been downloaded by your endpoints (released at Wed, 19 Sep 2012 21:32:00 +0000).

There is no cleanup for this detection, and you will see it quarantined unless you have your on-access policy set to move or delete detections if cleanup is not possible. Please double check your SAV policy under cleanup; You want to ensure your secondary option (when cleanup is not available or does not work) to be set to ‘deny access’ and not delete or move. Once the detections have stopped, you can acknowledge the alerts in the Console, this way you can see who is still reporting it, and confirm it is trending down.

What To Do

You should ensure that endpoints are up to date with the latest IDE files.  This issue is resolved with javab-jd.ide which was released at Wed, 19 Sep 2012 21:32:00 +0000.
The MD5 for this IDE is 90e873330239722f58efabf8c27e7138.

Sophos Update Manager unable to update

If SUM is unable to update it is probable that files in the warehouse are failing to be decoded as they are being falsely detected as Shh/Updater-B.

To workaround this issue and successfully download the IDE file that fixes this issue follow these steps:

1.     Delete agen-xuv.ide from C:\Program Files\Sophos\Sophos Anti-Virus\ [C:\Program Files (x86)\Sophos\Sophos Anti-Virus\]

2.     Restart the 'Sophos Anti-Virus Service'

3.     Update SUM via the Sophos Enterprise Console

Endpoints unable to update

If you have endpoints that are unable to update due to the false positive issue there are two solutions:

Option 1

1.     Add the following exclusions to the' Anti-Virus and HIPS' policy

C:\Documents and Settings\All Users\Application Data\Sophos\
C:\Program Files\Sophos\
C:\Program Files (x86)\Sophos\
C:\programdata\sophos\

2.     Select Groups in SEC and select 'Update Now'

3.     Once all groups have been updated remove the exclusions

Option 2

1.     Centrally disable On-Access scanning via policy in SEC

2.     Select Groups in SEC and select 'Update Now'

3.     Once a group has updated re-enable On-Access scanning via policy in SEC

Falsely detected files have been deleted

In the case that the 'Anti-Virus and HIPS' policy has been set to delete files if they are unable to be cleaned up it will be necessary to re-protect these endpoints as certain Sophos binaries required for updating may have been removed.

If you need more information or guidance, then please contact technical support.

 

 

The above information can be found on our website: -http://www.sophos.com/en-us/support/knowledgebase/118311.aspx

 

The second area of concern is then dependent on how your customers have set their AV policy, as you may wish to note the following points:

 

1. If they have the policy set to Sophos Default (Deny Access Only) – follow the KB and the endpoints will be able to update, then acknowledge any alerts in the console.

  

2. If they have the policy set to Deny Access and Move to default location – Then follow the KB, but you will need to manually copy the quarantined files (back to their correct locations.

Note - The quarantine folder on Windows 7 is C:\ProgramData\Sophos\Sophos Anti-Virus\INFECTED

 

3. If they have the policy set to Delete – Then the current resolution is to Re-Protect the Machines from SEC or re-deploy the client via your other application deployment routes