• The threat detection engine and threat data have been updated.

• (DEF 17535) In Sophos Enterprise Console version 3.0, device control error messages display error numbers rather than error messages. For a full list of the error numbers and their meaning, see Sophos support knowledgebase article 35958.

  This problem is fixed in Enterprise Console 3.1.

• (DEF 20165) If a policy is applied that specifies that CD-ROM/DVD drives are to be blocked, certain virtual CD emulators are blocked as well. For more information, see Sophos support knowledgebase article 36801.
• (DEF 19251) Blocked Bluetooth devices might generate multiple alerts on the workstation and Sophos Enterprise Console. For more information, see Sophos support knowledgebase article 35927.
• (DEF 17697) On Windows 2000/XP/2003, Sophos Anti-Virus logs invalid device names and filenames for devices that have a name that is longer than 254 characters.
• (CR 28114) When Sophos Anti-Virus detects a controlled application on a remote share, the alert always shows that the application was detected on the local computer.
• (CR 27792) Controlled applications that are installed on the computer can appear in Quarantine manager regardless of whether they have been run by a user. This is caused by Windows Explorer performing a file-open action on the application when it displays lists of files.
• (CR 26836) Desktop messages that report detection or blocking of threats or suspicious behavior can close without user interaction.
• (CR 22440) The Sophos Anti-Virus system tray icon may not be displayed. In this case, the ability to display desktop messages may be lost until the icon is redisplayed, although Sophos Anti-Virus does continue to detect threats. To redisplay the icon, on the taskbar, click Start, point to Programs, point to Startup, and then click AutoUpdate Monitor.
• (CR 25838) Files that trigger suspicious file, suspicious behavior, or buffer overflow detections appear on all Authorization manager tabs, instead of just the relevant tab.
• (CR 25629) If there has been a previous Windows installation, the Scan my computer progress dialog box can display 99% completed for a long time.
• (CR 24675) If the Detect but allow to run check box is selected in the Enterprise Console application control policy, the Sophos Anti-Virus log may display multiple entries for a single detected application.
• (CR 26129) When scanning offline storage folders using a right-click scan, with on-access scanning enabled, some threats are not reported to the user.

• (WKI 19039) Sophos Anti-Virus does not block removable storage devices that are used as system drives. Blocking of such devices typically destabilizes the operating system.

For technical support, visit http://www.sophos.com/support.

If you contact technical support, provide as much information as possible, including the following:

• Sophos software version number(s)
• Operating system(s) and patch level(s)
• The exact text of any error messages

Copyright © 2007, 2008 Sophos Group. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the licence terms or you otherwise have the prior permission in writing of the copyright owner.

Sophos and Sophos Anti-Virus are registered trademarks of Sophos Plc and Sophos Group. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.