"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
You may need to configure the port used by Sophos AutoUpdate for Location Roaming, if another application already uses this port or if you need to change it because of your company's internal best practice guidelines.
The Location Roaming port in Sophos AutoUpdate (SAU) can be configured in a number of ways:Option 1The configuration can be set in SAU’s own configuration file, in iupd.cfg.
At the bottom there is a section like this[global.IntelligentUpdating]Enabled = 1SubscriptionID = 1F6DFB2C-3DF7-452c-BA27-35B0F31FC2D3PortNumber = 51235Change the port number to the one you want to use.
Option 2When exporting the SAU configuration into an XML file (sauconf.xml) it is now possible to add an element to specify the Location Roaming port:
<AUConfig platform="Falcon">.....</AUConfig><intelligent_updating Enabled="true" SubscriptionPolicy="1F6DFB2C-3DF7-452c-BA27-35B0F31FC2D3"PortNumber="51235"/>
Change the port number to the one you want to use.
Option 3Use a registry override:
Under the SAU registry hive, HKLM\Software\Sophos\AutoUpdate, create a DWORD called IntelligentUpdatingPort
Set the value of the new DWORD too the required port number.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.