"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
After making a change to your Sophos license you may encounter problems with the Sophos Update Manager (SUM) failing to download particular packages which no longer exist in your subscription. The below errors maybe encounted: Update Managers View: Software delivery failed will be seen the 'Errors' column. You will also see either of the following messages in the 'Alerts' column against one or more of your Sophos Update Managers (SUM):
When you right click on the Update Manager and select 'View Update Manager details' the following errors could be displayed:
The SumTrace log will display an error similar to the below extract. Details of the SUMTrace log can be found in the following article: 116523 2015-05-15 16:42:54 : Cmd-ALL << [E402E][F26F7EC0-1302-4DA7-8B6B-A5383051D41A][F26F7EC0-1302-4DA7-8B6B-A5383051D41A][10.3.7.3530.2] Synchronise operation failed when synchronising payload 'F26F7EC0-1302-4DA7-8B6B-A5383051D41A' because a package could not be found. Package: F26F7EC0-1302-4DA7-8B6B-A5383051D41A
2015-05-15 16:42:54 : Cmd-ALL << [E402E][F26F7EC0-1302-4DA7-8B6B-A5383051D41A][F26F7EC0-1302-4DA7-8B6B-A5383051D41A][10.3.7.3530.2] Synchronise operation failed when synchronising payload 'F26F7EC0-1302-4DA7-8B6B-A5383051D41A' because a package could not be found. Package: F26F7EC0-1302-4DA7-8B6B-A5383051D41A
If you have any endpoints updating for the affected warehouse you may also notice these endpoints stop updating:
Applies to the following Sophos product(s) and version(s Sophos Update ManagerSophos Anti-Virus for Windows 2000+
Either a license change has taken place or the software subscribed to is no longer available.
After carrying out the above steps if any of the Endpoints are still pointing to the affected update location they will start to fail to update. The following error can be seen in the Computer details section of the endpoint: 0000006e: This error appears as the endpoint is still pointing to an update location that no longer exists. To resolve this:
80040426 and 80040421: These alert can be safely ignored however both alerts will need to be acknowledged. To do this:
Error code 80040421 relates to retirements of old versions of software. When a product is approaching retirement, the console will display warning messages.
In a situation where a change of license occurs, this can result in the SUM installation being directed to a different URL to fetch updates. The product set available at the new URL may be different from the previous location used, to reflect new capabilities that are available in the new license. As part of switching between URLs, SUM retires its subscriptions to the products it previously used, and sets up new ones to corresponding products in the new location.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.