This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Problemas con Sophos Endpoint + .dll

Buenos dias,

Recientemente hemos adquirido Sophos Endpoint + Intercept X.

Las pruebas que hemos hecho con un equipo en Dominio y con Windows 10 nos resultan algo extra;as.

Cuando lleva un rato funcionando o hemos instalado nuestro ERP, Sage Murano, Office Pro, etc...desaparece las Opciones de red, opciones de actualizacion y cualquier opcion del propio Explorador de Windows. Es mas el teclado se vuelve en Ingles y no puedes modificarlo!

Desconozco que esta pasando o si algo no tenemos bien configurado, pues es la primera vez que nos ocurre esto.

Gracias

This thread was automatically locked due to age.

Parents

0 Daniel Santamaría over 6 years ago

English

Good morning,

We recently acquired Sophos Endpoint + Intercept X.

The tests that we have done with a computer in Domain and Windows 10 we find something strange

When it has been running for a while or we have installed our ERP, Sage Murano, Office Pro, etc ... it disappears the Network options, update options and any option of Windows Explorer itself. It is more the keyboard becomes English and you can not modify it!

I do not know what is happening or if something we do not have well configured, it is the first time this happens to us.

Thank you
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to Daniel Santamaría

Hello Daniel Santamaría,

sorry but my Spanish is non-existent.
This is Endpoint+Intercept X managed by Central, isn't it? Are there any alerts or events in Central Admin? qué opciones de actualización desaparecen - can you show a screenshot?

Christian
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 QC over 6 years ago in reply to Daniel Santamaría

Hello Daniel Santamaría,

sorry but my Spanish is non-existent.
This is Endpoint+Intercept X managed by Central, isn't it? Are there any alerts or events in Central Admin? qué opciones de actualización desaparecen - can you show a screenshot?

Christian
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Daniel Santamaría over 6 years ago in reply to QC

Yes, is Endpoint+Intercept X managed by Central.

For example, I click on a folder and top options

I try to click on Ethernet Options.

Everything has disappeared, it is as if certain .dll had been removed

This a log from this computer

31 ene. 2018 10:21	Actualización realizada correctamente
	31 ene. 2018 10:07	Actualización realizada correctamente
	31 ene. 2018 9:52	Malware marcado como resuelto
	31 ene. 2018 9:52	Malware marcado como resuelto
	31 ene. 2018 9:52	Malware marcado como resuelto
	31 ene. 2018 9:52	Malware marcado como resuelto
	31 ene. 2018 9:52	Malware marcado como resuelto
	31 ene. 2018 9:51	Restaurado: 'C:\Program Files\Ricoh\MDM\bin\DBRestore.exe' y elementos asociados	Detalles
	31 ene. 2018 9:51	Restaurado: 'C:\Program Files\Ricoh\MDM\bin\NotificationPopup.exe' y elementos asociados	Detalles
	31 ene. 2018 9:48	Restaurado: 'C:\Program Files\Ricoh\MDM\bin\DBBackup.exe' y elementos asociados	Detalles
	31 ene. 2018 9:48	Aplicación maliciosa limpiada: 'ML/PE-A' en 'C:\Program Files\Ricoh\MDM\bin\DBRestore.exe'	Detalles
	31 ene. 2018 9:48	Aplicación maliciosa limpiada: 'ML/PE-A' en 'C:\Program Files\Ricoh\MDM\bin\NotificationPopup.exe'	Detalles
	31 ene. 2018 9:47	Aplicación maliciosa limpiada: 'ML/PE-A' en 'C:\Program Files\Ricoh\MDM\bin\DBBackup.exe'	Detalles
	31 ene. 2018 9:46	Aplicación maliciosa detectada: 'ML/PE-A' en 'C:\Program Files\Ricoh\MDM\bin\NotificationPopup.exe'
	31 ene. 2018 9:46	Aplicación maliciosa detectada: 'ML/PE-A' en 'C:\Program Files\Ricoh\MDM\bin\DBRestore.exe'
	31 ene. 2018 9:46	Aplicación maliciosa detectada: 'ML/PE-A' en 'C:\Program Files\Ricoh\MDM\bin\DBBackup.exe'
	31 ene. 2018 9:11	Aplicación maliciosa limpiada: 'ML/PE-A' en 'C:\Program Files (x86)\Sage\Sage Murano\Regsvr32.exe'	Detalles
	31 ene. 2018 9:11	Es necesaria una limpieza manual de la aplicación maliciosa: 'ML/PE-A' en 'C:\Users\TIC\AppData\Local\Sage\Temp\Instalar\Entorno\13.00.000\Regsvr32.exe'	Detalles
	31 ene. 2018 9:02	Aplicación maliciosa detectada: 'ML/PE-A' en 'C:\Program Files (x86)\Sage\Sage Murano\Regsvr32.exe'
	31 ene. 2018 9:02	Aplicación maliciosa detectada: 'ML/PE-A' en 'C:\Users\TIC\AppData\Local\Sage\Temp\Instalar\Entorno\13.00.000\Regsvr32.exe'
	30 ene. 2018 15:47	Actualización realizada correctamente
	30 ene. 2018 15:41	Se recomienda reiniciar después de la actualización del software
	30 ene. 2018 15:35	Actualización realizada correctamente
	30 ene. 2018 15:35	Nuevo equipo protegido: PCTIC
	30 ene. 2018 15:30	Equipo Reprotegido: PCTIC

0 QC over 6 years ago in reply to Daniel Santamaría

Hello Daniel Santamaría,

thanks. So ... did you click on the link about the detections?

Aplicación maliciosa detectada: 'ML/PE-A' en 'C:\Users\TIC\AppData\Local\Sage\Temp\Instalar\Entorno\13.00.000\Regsvr32.exe'

Sage is your ERP software, isn't it? Strange that it should come with its own copy of regsvr32.exe but who knows. It might be a false positive but then there are similar detections in the Ricoh directory, thus the detections could be genuine.

Please see the ML/PE-A article, if you can run the Root Cause Analysis it might give some insight.
I'd suggest that you join the Intercept X group then I can move this thread to the Intercept X forum that is the better place. Last but not least you should contact Support.

Christian
Cancel
Vote Up 0 Vote Down

Cancel