We have been using Sophos intercept x advanced with MTR for about 6 weeks. Since then, our bandwidth has dropped 90%. We use a gigabit internet connection and have previously achieved the following values ​​in a speed test in the browser: Down: 900MB…

Well hello there, is there any way to trigger a FileScan from commandline with Intercept X? I know with the old endpoint protection you could use the sav32cli.exe, but i can't find this in the new intercep X agent. Hope some one can help. Greeting …

How can i exclude these apps from being detected as PUA? Do i have to exclude every single app one by one?

Hi, I have a Application with unc path "\\server-01\test$\xyz.exe". The shortcut of the application is in the same folder with "conf.json" in it. Sophos Central blocked this program without any events! Can anybody help ? best regards, Tho…

Hello, since last week, for unknown reason our Sophos Endpoint delete all WMV files on computers. This is the event : Malware detected: 'W32/GetCodec-A' at 'XXX\Intro discours.wmv' Any idea why it's happen now?? I already created a ticket to…

Hello, i use gsudo.exe with Windows Terminal to start CMD or Powershell with administrative rights but since i use Sophos Endpoint it shuts down the Terminal app every time the gsudo process opens a new tab. The Error message is "Malicious Behaviour…

Hi, I have an Exchange server 2019 wich have not been correctly patched since one month ago; it had Sophos Advanced Endopoint installed allready + Sophos Firewall Intercept X in front (protected by WAF - no DNAT) I started questioning my self as soon…

We received a high alert on one of our workstations. The user was transferring files from their phone via Bluetooth. CryptoGuard detected ransomware in C:\Windows\System32\fsquirt.exe We ran a scan and it came up clean. There's nothing in the…

Hello, a customer's Exchange 2016 Server (installed on Windows Server 2016) was previously running Sophos Endpoint Protection Standard. Having set the Antivirus exclusions according to the list published by Microsoft, it was running fine. After…

Hello, we are evaluating sophos as av for our servers: what is not understand is there any real-time scanning for linux? is that a feature only for windows system? uploading a virus test file (eicar.com) is undetected until a scan; is that how is supposed…

Ever since I upgraded to Big Sur, I've noticed that Sophos has begun to interfere dramatically whenever I run Jest tests. CPU usage for Sophos spikes to around 400% when running even a modest Jest test program, with 71 tests currently taking 98.6 seconds…

Hi guys, having a (performance) problem with an application. I built a new policy / enhanced the Base Policy and added some (file and process) exceptions. How can I check on one particular client if these exceptions are working as they should? Using…

There's a way to limit the disk usage during sophos antivirus scan? We have machines with always active background programs that open and close communications with other machines, but if they have saturated resources, sometimes errors occur and operators…

Hello All, What is a quick fix when Sophos Endpoint service fails to start and the endpoint is blocked on LAN and WAN due to security heartbeat? This happens on random PCs especially when the software is updated. How to start the service. …

Hi, We have a Global Exclusion set for an executable file. We now no longer want this exclusion to take effect. I can't seem to find a way to delete the exclusion. Can anyone help with this? Many thanks.

I have two endpoints at two totally unrelated clients where Sophos detected Mal/Polazert-A. Sophos is good at telling me about it, but it doesn't give me any options to remove it. Every time the client reboots their computer, they get a popup from Sophos…

Hey folks, Does anybody know how and what triggers ransomware attack detection? We have a process via batch script and it calls for GPG.exe encryption on the files. This process are executed via remote workstation, and the target files are from our…

According to Sophos KB-000035264 support.sophos.com/.../KB-000035264 it states the following "By default, Sophos Central automatically uses vendor-recommended exclusions for certain widely-used applications. You can also set up your own exclusions in…

Hi all, since a few months we are facing heavy problems with our terminal server (rdsh) in combination with Sophos Intercept X Advanced and user profile disks. The User Profile Disk (UPDs) are stored on a normal file server and are accessed through a…

hi, We have recently installed endpoint on a site but we have a user who does payroll and sophos is blocking when they export / create multiple pdfs in one go. A couple work then it comes up with an error saying the process cant complete as the xxxx…

Hi folks, Please could you share with me the steps to run an usb scanning?, until now I just have found some explanations about if it runs automatically or not, but I just need to know how run it manually. Regards, Jaime L