Sophos rushed to release an update over the weekend after system administrators started complaining that the security firm’s products had flagged a legitimate Windows file as malicious.
Users of Sophos Home, UTM, Central and Enterprise Console products were notified that the Troj/FarFli-CT malware was detected in C:WindowsSystem32winlogon.exe, a component of the Windows login system.
Winlogon.exe is known to be abused by malware, but an error in one of Sophos’ endpoint protection verification systems caused products to detect the file as a threat even without the presence of an infection, leading to blue or black screens in some cases.
Leave a reply
