Sophos false-positive malware havoc continues globally

“In our 25-year history, Sophos has never experienced an incident quite like this, and we are taking every effort to resolve this issue as fast as possible,” said Hagerman. “Once we have made it past this critical stage of assisting our customers to get back to normal, we will then share our full and detailed explanation of the root cause analysis behind this incident and the steps we have implemented to prevent this in the future. Sophos owes this to you.”

He added, “Again, on behalf of the company, I am deeply sorry for any disruption this has caused.”

Sophos inadvertently sent business users into a tailspin last Thursday by releasing an update that classified all update utilities – including itself – as a virus. PCs running Sophos went into hari-kari mode, classifying its software as SSH/Updater-B malware and alerting system administrators of massive infections. Sophos quickly scrambled a fix, but trouble is lingering because the snafu resulted in required systems being quarantined – meaning that system updates can’t be applied.

Sophos has now provided more information on fixing the problem for both enterprise users and those with stand-alone computers, but the havoc lingers on thanks to those system quarantines.

“Our top priority across the entire company is to ensure every single system within every single affected customer is back to a normal, productive, and protected state,” Hagerman assured customers, intimating it was an all-hands-on-deck situation at the company. “We have Sophos team members cancelling or rescheduling vacations, leaves of absence and other business activities to ensure we have mobilized every available resource to the task at hand: To get every remaining customer case resolved as quickly as possible.”

Sophos also made it clear that the scope of the problem is worldwide: It has increased to maximum capacity phone support centers in Abingdon (UK), Boston, Karlsruhe (Germany), Madrid, Milan, Paris, Sydney, Tokyo, Vancouver, Wiesbaden (Germany) and other cities around the globe.

Still, customers will have a wait to get through. “While technical support call volumes have started to significantly subside and hold queues have started to drop, I understand that our hold queues still remain larger than normal, and in some instances, callers have been unable to connect with us,” the company said. “We are doing everything possible to address the queue as fast as we can.”

 

What’s hot on Infosecurity Magazine?