mirror of
https://github.com/ayeskatalas/Sophos-Removal-Tool.git
synced 2026-04-25 02:35:52 +03:00
[GH-ISSUE #3] ie, edge, chrome, ff all report exe file has virus, worked in the end though #3
Labels
No labels
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/Sophos-Removal-Tool#3
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @xenek on GitHub (Sep 2, 2020).
Original GitHub issue: https://github.com/ayeskatalas/Sophos-Removal-Tool/issues/3
on system with broken sophos install
(3.1.1,
can't remove via programs & features, says failed to stop the autoupdate service,
can't install over top, says pending installer requires restart)
when downloading exe, reports virus detected
was able to still download the zip with firefox, unzip with 7zip,
after using this reg file, https://www.tenforums.com/tutorials/64349-run-administrator-add-ps1-file-context-menu-windows-10-a.html
was able to run as admin,
still get heaps of 'access denied'
no matter if I run the exe or the ps1 as admin
errors follow:
ERROR: ERROR: Access is denied.
ERROR:
ERROR: ERROR: Access is denied.
ERROR:
ERROR: ERROR: Access is denied.
ERROR:
ERROR: ERROR: Access is denied.
ERROR:
ERROR: ERROR: Access is denied.
ERROR:
ERROR: The requested pause, continue, or stop is not valid for this service.
ERROR:
More help is available by typing NET HELPMSG 2191.
ERROR: The service name is invalid.
ERROR:
More help is available by typing NET HELPMSG 2185.
ERROR: The requested pause, continue, or stop is not valid for this service.
ERROR:
More help is available by typing NET HELPMSG 2191.
ERROR: The requested pause, continue, or stop is not valid for this service.
ERROR:
More help is available by typing NET HELPMSG 2191.
ERROR: The service name is invalid.
ERROR:
More help is available by typing NET HELPMSG 2185.
ERROR: The requested pause, continue, or stop is not valid for this service.
ERROR:
More help is available by typing NET HELPMSG 2191.
ERROR: The requested pause, continue, or stop is not valid for this service.
ERROR:
More help is available by typing NET HELPMSG 2191.
ERROR: The service name is invalid.
ERROR:
More help is available by typing NET HELPMSG 2185.
ERROR: The requested pause, continue, or stop is not valid for this service.
ERROR:
More help is available by typing NET HELPMSG 2191.
ERROR: The requested pause, continue, or stop is not valid for this service.
ERROR:
More help is available by typing NET HELPMSG 2191.
ERROR: The requested pause, continue, or stop is not valid for this service.
ERROR:
More help is available by typing NET HELPMSG 2191.
ERROR: The requested pause, continue, or stop is not valid for this service.
ERROR:
More help is available by typing NET HELPMSG 2191.
Executing (\ASUS\ROOT\CIMV2:Win32_Service.Name="SAVAdminService")->stopservice()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
ReturnValue = 5;
};
ERROR: System.Management.Automation.RemoteException
Executing (\ASUS\ROOT\CIMV2:Win32_Service.Name="SAVService")->stopservice()
Method execution successful.
ERROR:
Out Parameters:
instance of __PARAMETERS
{
ReturnValue = 5;
};
Executing (\ASUS\ROOT\CIMV2:Win32_Service.Name="SntpService")->stopservice()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
ReturnValue = 5;
};
ERROR:
Executing (\ASUS\ROOT\CIMV2:Win32_Service.Name="Sophos AutoUpdate Service")->stopservice()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
ReturnValue = 5;
};
ERROR:
Executing (\ASUS\ROOT\CIMV2:Win32_Service.Name="Sophos Clean Service")->stopservice()
Method execution successful.
ERROR:
Out Parameters:
instance of __PARAMETERS
{
ReturnValue = 5;
};
Executing (\ASUS\ROOT\CIMV2:Win32_Service.Name="Sophos Endpoint Defense Service")->stopservice()
Method execution successful.
ERROR:
Out Parameters:
instance of __PARAMETERS
{
ReturnValue = 5;
};
Executing (\ASUS\ROOT\CIMV2:Win32_Service.Name="Sophos File Scanner Service")->stopservice()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
ReturnValue = 5;
};
ERROR:
Executing (\ASUS\ROOT\CIMV2:Win32_Service.Name="Sophos Health Service")->stopservice()
Method execution successful.
Out Parameters:
ERROR:
instance of __PARAMETERS
{
ReturnValue = 5;
};
Executing (\ASUS\ROOT\CIMV2:Win32_Service.Name="Sophos MCS Agent")->stopservice()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
ReturnValue = 5;
ERROR:
};
Executing (\ASUS\ROOT\CIMV2:Win32_Service.Name="Sophos MCS Client")->stopservice()
Method execution successful.
ERROR:
Out Parameters:
instance of __PARAMETERS
{
ReturnValue = 5;
};
Executing (\ASUS\ROOT\CIMV2:Win32_Service.Name="Sophos Safestore Service")->stopservice()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
ReturnValue = 5;
};
ERROR:
Executing (\ASUS\ROOT\CIMV2:Win32_Service.Name="Sophos System Protection Service")->stopservice()
Method execution successful.
ERROR:
Out Parameters:
instance of __PARAMETERS
{
ReturnValue = 5;
};
Executing (\ASUS\ROOT\CIMV2:Win32_Service.Name="Sophos Web Control Service")->stopservice()
Method execution successful.
ERROR:
Out Parameters:
instance of __PARAMETERS
{
ReturnValue = 5;
};
Executing (\ASUS\ROOT\CIMV2:Win32_Service.Name="swi_filter")->stopservice()
Method execution successful.
ERROR:
Out Parameters:
instance of __PARAMETERS
{
ReturnValue = 5;
};
Executing (\ASUS\ROOT\CIMV2:Win32_Service.Name="swi_service")->stopservice()
Method execution successful.
ERROR:
Out Parameters:
instance of __PARAMETERS
{
ReturnValue = 5;
};
ERROR: ERROR: The process "ALMon.exe" not found.
ERROR: ERROR: The process "ALsvc.exe" with PID 6408 could not be terminated.
ERROR: Reason: Access is denied.
SUCCESS: The process "swi_fc.exe" with PID 4716 has been terminated.
ERROR: ERROR: The process "swi_filter.exe" with PID 6744 could not be terminated.
ERROR: Reason: Access is denied.
ERROR: ERROR: The process "spa.exe" not found.
@xenek commented on GitHub (Sep 2, 2020):
To try something different, I restarted in safe mode command prompt only, (btw this is win10 home, w/latest updates as of 20200903 afaik)
then I ran the exe a few times, (failed, had to ctrl-c the stopped removal process each time)
then I typed in explorer and from the desktop in safe mode tried to remove sophos through apps & features a few times (failed, no internet)
then..
restarted in normal mode,
then I tried to reinstall sophos, and it worked!
full install went through
sophos now fully functional, and has been added to personal sophos client list in web app
now to try remove again, and see if full uninstaller removes correctly...
@xenek commented on GitHub (Sep 3, 2020):
Confirming that sophos removal was successful, and also - that it didn't detect the removal tool as a virus prior to running it. Ran malwarebytes, it didn't find any threats. Ran Trend Micro, it identified the exe in this github acc as a virus.
TROJ_GEN.R002C0DG520
trend micro also detected another file - unRlG+wx.exe.part - in appdata/local/temp with a timestamp that's pretty close to when I ran the exe.
Anyway, back to the main removal exe here,
Virustotal says 47/67, so there's some opportunity for it not being a virus, and the fact that it's trying to remove and disable Sophos (even though there's a pretty transparent powershell script that I could have run) suggests it's a good candidate for a false positive.
Other interesting incidentals, Trend Micro hasn't stopped me from restoring it from quarantine, and I've been able to upload it to a few sites now, perhaps of most interest is the CAPE tool, which I've not used before. It seems to provide an analysis that's easy to interpret, relatively speaking.
https://www.capesandbox.com/analysis/54577/
Even though much of the analysis seems alarming, at the end it looks mostly legit.
A quick note to ayeskatalas - thanks - I didn't have to reinstall windows to remove the broken AV. Could you add some notes about what the exe is for though?