Client 18.5.25 / Sophos detects Exploit

[gregtomasger]

Hi i have Problems with the new 3CX Client 18.5.25. Sophos Antivirus detects the software as a potentially dangerous exploit and terminates the process. All old versions run fine. According to Sophos, I can of course whitelist the app and no longer monitor it, but that's not ideal. Does anyone else have this problem? Does anyone at 3CX know of a change in the current client that could be causing this? And will it be fixed ??

Thank you

 

[NickD_3CX]

Hi!

Could you please tell us exactly which version of Sophos AV you are using? Also, when Sophos finds this as a threat, does it have some kind of option to print a report to send to us? This could help us more precisely find what it doesn't like.

 

[Ronin]

Hello,

We also use Sophos UTM 9 and the 3cx desktop app is reported as malware since today.
I have sent logs to @NickD_3CX.

 

[SweetAction]

Related:
https://www.3cx.com/community/threads/welp-that-sucks.84831/

 

[NickD_3CX]

After looking into this it looks like whenever an AV software detects Desktop App as malicious activity, the following files will need to be excluded from the scanning:

C:\Users\*\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe
C:\Users\*\AppData\Local\Programs\3CXDesktopApp\Update.exe

Other vendors have also reported very similar issues and instruct users to exclude file, like MS Teams, which from the looks of it is also Electron and also uses the same update method.

 

[Daniel_ion]

Whitelisting the app and updater doesnt work for me.

In my case; Client 18.5.26 / Sophos Intercept X / Endpoint Advanced i had to create a global exclution.

Sophos Central -> global Settings -> General -> global exclutions for "Exploit Mitigation (Windows) - Lockdown Autostart" (The event was allready registered and i just had to select it)

After saving this i had to wait a few minutes and restart my computer.