Thread Info
  • Locked Locked
  • Replies 5 replies
  • Subscribers 13 subscribers
  • Views 13904 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Exploit APCViolation - Executables including "SophosClean.exe"

Brett Burda

community.sophos.com/.../128101

In case anyone else runs into this and is looking for answers. Since 8:00pm CST on 1-12-2018 we are receiving "APCVoilation" alerts blocking all sorts of executables - explorer.exe, sophosclean.exe, svchost.exe...

According to support, this is caused by the recent update to help mitigate "... a very recent method of attack." For the machines that have this problem, roughly 100 out of 1000 machines, the only differentiator that I can tell is Netmotion VPN software. These machines are anywhere from usable with virus alert popups in the corner, to unusable with explorer constantly crashing and restarting.

I will update this when we have the issue resolved.



This thread was automatically locked due to age.
Parents

  • Update - We have a resolution to our issue - just taking time to mitigate some of the severe cases.

    Sophos released an update that resolved this issue.  The issue was the APCMitigation engine in Hitmanpro was "tweaked".  The "tweak" didn't play nicely with VPN applications - this is how it was described to me, and from the machines that we had affected, would make sense.  Our VPN software is Netmotion if curious.

     

    As long as the machines were still online, they received the updated "definition" from Sophos thru the updater service.  What this actually did was remove the registry key "HKEY_LOCAL_MACHINE\SOFTWARE\HitmanPro.Alert APCMitigation=on".  I am still not finished with my clean up due to machines going offline - they are remote machines after all.  We did notice quite a few machines where either the VPN software or other networking related services/executables were targeted incorrectly by Sophos, that we had to touch them manually.  If this was the case, we modified the above key to "=off" per supports instructions.  NOTE - this was given as a "critical" fix from support, should not be necessary for most.

     

    Due to the insane amount of "malicious" files it incorrectly flagged, we continued to get the message pop ups regarding Sophos stopping attacks.  Turns out Sophos was only processing the tens of thousands of back logged .json files.  We created the below script to quickly add the registry value for disabling the APCMitigation as well as deleting the back logged notification files.

    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\HitmanPro.Alert" /t REG_SZ /v APCMitigation /d off /f
    del "c:\ProgramData\Sophos\Health\Event Store\Incoming\*.*" /s /q

     

    Please let me know if you have any questions on above.

Reply

  • Update - We have a resolution to our issue - just taking time to mitigate some of the severe cases.

    Sophos released an update that resolved this issue.  The issue was the APCMitigation engine in Hitmanpro was "tweaked".  The "tweak" didn't play nicely with VPN applications - this is how it was described to me, and from the machines that we had affected, would make sense.  Our VPN software is Netmotion if curious.

     

    As long as the machines were still online, they received the updated "definition" from Sophos thru the updater service.  What this actually did was remove the registry key "HKEY_LOCAL_MACHINE\SOFTWARE\HitmanPro.Alert APCMitigation=on".  I am still not finished with my clean up due to machines going offline - they are remote machines after all.  We did notice quite a few machines where either the VPN software or other networking related services/executables were targeted incorrectly by Sophos, that we had to touch them manually.  If this was the case, we modified the above key to "=off" per supports instructions.  NOTE - this was given as a "critical" fix from support, should not be necessary for most.

     

    Due to the insane amount of "malicious" files it incorrectly flagged, we continued to get the message pop ups regarding Sophos stopping attacks.  Turns out Sophos was only processing the tens of thousands of back logged .json files.  We created the below script to quickly add the registry value for disabling the APCMitigation as well as deleting the back logged notification files.

    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\HitmanPro.Alert" /t REG_SZ /v APCMitigation /d off /f
    del "c:\ProgramData\Sophos\Health\Event Store\Incoming\*.*" /s /q

     

    Please let me know if you have any questions on above.

Children
No Data
Unfiltered HTML