Virus Like Activity

Hello Syntax

What options have you enabled in Sophos?

Are you doing rootkit scanning? What about suspicious scanning?

If Sophos doesnt report on either of those, i dont think it would be threat related.

I have come across two scenarios where i though it might be a threat due to behaviour. 

When creating a folder, instead of the the default 'New Folder' it started giving birds name. Strange i know.

Turned out to be a recently installed version of alzip. 2hours later laughing at the amount of time it took to figure it out.

2nd scenario, Sophos wasnt detecting anything 'abnormally' suspicious.

Turned out the company screen saver (which waslegate during the original deployment of Sophos), was demend susipicious, and was authorized.

later on, the screen saver was infected and distributed to every machine in the network.

Pondering why Sophos wasnt detecting anything, becuase it had been previously authorized.

If you have enabled Sophos to scan fully, with suspicious, rootkit, etc and it doesnt report anything

Look into recently installed programs, look at what has been authorized.

On a side note, a few years ago I once saw a program (april fools joke program) That would change the mouse into something else for about 5seconds. This happended every 10 minutes.

It wasnt a threat but it always stuck by me. If i didnt know the program was capable of doing it, i would think it is a threat.

The Threats ive seen now days dont really do that. They not out to impress the users, they out to impress the people they drive past in their new car from fraud .

Hello Syntax

What options have you enabled in Sophos?

Are you doing rootkit scanning? What about suspicious scanning?

If Sophos doesnt report on either of those, i dont think it would be threat related.

I have come across two scenarios where i though it might be a threat due to behaviour. 

When creating a folder, instead of the the default 'New Folder' it started giving birds name. Strange i know.

Turned out to be a recently installed version of alzip. 2hours later laughing at the amount of time it took to figure it out.

2nd scenario, Sophos wasnt detecting anything 'abnormally' suspicious.

Turned out the company screen saver (which waslegate during the original deployment of Sophos), was demend susipicious, and was authorized.

later on, the screen saver was infected and distributed to every machine in the network.

Pondering why Sophos wasnt detecting anything, becuase it had been previously authorized.

If you have enabled Sophos to scan fully, with suspicious, rootkit, etc and it doesnt report anything

Look into recently installed programs, look at what has been authorized.

On a side note, a few years ago I once saw a program (april fools joke program) That would change the mouse into something else for about 5seconds. This happended every 10 minutes.

It wasnt a threat but it always stuck by me. If i didnt know the program was capable of doing it, i would think it is a threat.

The Threats ive seen now days dont really do that. They not out to impress the users, they out to impress the people they drive past in their new car from fraud .