"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
It is possible to disable some Sophos balloon tips on endpoint computers or all system tray (Windows) balloon tips.
Applies to the following Sophos product(s) and version(s) Sophos Anti-Virus for Windows 2000+Sophos Endpoint Security and Control
Before you start, verify the on-access scanning status of the endpoint: Checking on-access scanning.
Important: This will turn off some desktop alerts for Sophos on the local computer. It may be desirable to only do this for certain groups of computers. If the notification is disabled this also means that the Sophos shield will not change its status to highlight an event - see article 120679 for more details.
To only apply this change to a certain group of computers, you must edit or create a new Anti-virus and HIPS policy applied to the required group.
The following table lists each policy and the relevant events for which the balloon tips can be disabled:
Not all balloon alerts can be disabled in this manner. If the event is not listed in the table above you may need to consider disabling all balloon tips (see below).
Disable all balloon notifications using a registry key setting, as per the Microsoft article:
Note: The steps in this article disable all balloon tips in the notification area for this computer.
This can be done per machine or group of machines using GPO, and will not require a change of policy in the Enterprise Console or Sophos Control Center.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.