How to shoot yourself in the foot – Sophos style ?


This week was a low point for Sophos – the antivirus company. With remote email notification for all Sophos clients – the moment the first email arrived I knew we were in for trouble. Having alerted my colleagues and have notified Sophos support – we watched the drama unfold.

The Problem? An update that caused a false positive for Sophos own software and for other applications that check for updates at load time.

The Result ? Machines affected right across the world as the antivirus started fighting with itself.

The Recovery ? Basically the worst affected clients were those that had applications mistakenly detected as viral because of the false positive. Briefly we were able to disable the on access scanning and other components of the antivirus to allow business to continue working. We were then able to apply the changes recommended by Sophos support to get back on an even keel.

The Outcome ? Sophos support has always been a cut above the rest for me. Their local UK presence and global reach has differentiated them from the rest of the pack. They have not been perfect with product releases – those of you who went through the Puremessage slow release program will no doubt be nodding their heads slowly.

However – this should not have happened.