This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos cloud endpoint: Multiple users getting "Caller Check Exploit Prevented in Microsoft Excel" when using custom spreadsheets

I need a resolution for this false positive that does not completely whitelist Excel.

This is directly relevant to the following thread:

https://community.sophos.com/intercept/f/information/82464/microsoft-power-query-for-excel---false-flagging-by-intercept-crashes-excel

This was supposed to be resolved by the end of November.

We need a resolution now.

This thread was automatically locked due to age.

Parents

0 yvesGourle over 6 years ago

Hi,

The way this problem is handled by Sophos is just mind-blowing!
From time to time we come to tell us "it's coming" and it has been months that it lasts!
This is probably because Excel is a little used software.

I do not understand that you can follow this as badly.

Regards,
Cancel
Vote Up 0 Vote Down

Cancel
0 Ashton Momot over 6 years ago in reply to yvesGourle

We have a case open for this as well - Sophos recommends moving the affected machines over to the Early Access program for 2.0. We have been testing internally for a few weeks without major issues (Just the firefox loadlib known issue), so we are pushing out to some of the affected machines this week.

I would not recommend adding a scanning exclusion for any Office products as they are common methods for ransomware...
Cancel
Vote Up 0 Vote Down

Cancel
0 Andre Butler over 6 years ago in reply to Ashton Momot

Greetings,

Any updates on this issue? I have some users who are experiencing this also, submitted ticket with Sophos Support.

Andre
Cancel
Vote Up 0 Vote Down

Cancel
0 Andre Butler over 6 years ago in reply to Andre Butler

Due to the fact that I have users who need to use this feature in Excel, I had to implement this "Workaround". According to Sophos Support, this issue is being worked by their Dev Team.

I added this location to the Global Scanning exclusion List:

C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel\ Integrated\bin\Microsoft.Mashup.Client.Excel.dll

Seems to be holding up so far :)

Regards,
Cancel
Vote Up 0 Vote Down

Cancel
0 Root___ over 6 years ago in reply to Andre Butler

Hey all!

I can tell you i have a test version which appears to be working fine now with all users. I have been told the fix should be released with an update in the coming weeks. DON'T GIVE UP HOPE!
Cancel
Vote Up 0 Vote Down

Cancel
0 skyisbluescreen over 6 years ago in reply to Root___

Dear,

We have Version - 3.6.8.604 and Major Issues of such kind are resolved

When We had 3.6.3.583 we had Incident Requests Showered.

Thanks

Neel
Cancel
Vote Up 0 Vote Down

Cancel
0 Andre Butler over 6 years ago in reply to skyisbluescreen

Good morning,

How do you upgrade from 3.6.3.583 to 3.6.8.604?

Thanks,

Andre
Cancel
Vote Up 0 Vote Down

Cancel
0 skyisbluescreen over 6 years ago in reply to Andre Butler

We had an automatic Upgrade of Sophos Exploit Prevention, Where the Component Self Updated to the newest version.

As a Workaround in the past we had to create a Separate Group and add an exception to the application for Exploit Prevention which was getting blocked.

We had issues with many applications getting blocked

Excel

PDFViewer.exe

Powerpoint
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 skyisbluescreen over 6 years ago in reply to Andre Butler

We had an automatic Upgrade of Sophos Exploit Prevention, Where the Component Self Updated to the newest version.

As a Workaround in the past we had to create a Separate Group and add an exception to the application for Exploit Prevention which was getting blocked.

We had issues with many applications getting blocked

Excel

PDFViewer.exe

Powerpoint
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data