Anti Malware alerting, blocking and cleaning Tonfotos

Neilineastbury

Hi there,

I am running the latest release (updated today), and my Sophos Home Premium endpoint protection is alerting with:

Application, file or content detected as malicious:
…./SquirrelTemp\tempm\lib\net45\tonfotos_ExecutionStub.exe

Application, file or content detected as malicious::
…/tonfotos\tonfotos.exe

It then quarantines both files.

This issue only started with an update I applied in mid-December last year.

I am able to acknowledge the alerts and then restore the files, however I’d prefer not to have any exceptions in my endpoint protection.

Interested to hear any reasons / theories why this has started happening.

Thanks alot

Andrey

Neilineastbury Based on this timing - no idea, unfortunately. Assuming you are downloading from the tonfotos.com, not from some shady web site, ofcourse.

If that would be around october/early november - that would coincide with date when we changed our digital signature certificate to new one as old one expired. Windows SmartScreen relies a lot on the digital signature to determine if this vendor is trusted or not. But it typically requires few thousands installs to build trust, and that milestone was passed in a week after first release with new certificate. For Microsoft we are now trusted vendor and no popups are shown when users download our distribution.

I can assume that other antimalware vendors also have some sort of white list of trusted vendors, but again, this does not seem to be related as we updated our certificate much earlier. I guess this is something Sophos-specific and only they can know.

My recommendation would be to complain to thier support. Since you are on Premium, they should listen and remove this false alarm.

Neilineastbury

Thanks for the quick reply!

Original installation was from tonfotos.com maybe a year ago, All subsequent updates have been from within the application.

I will raise a query with Sophos.