0

I am not very security-savvy, but after getting loads of viruses and malware, one of my business partners offered to install their best antivirus software on my computer - it's called Sophos.

A few weeks later I showed this to a relative of mine who found that the antivirus had also installed a software called "Sophos Remote Management". We googled it up but found virtually no information about it (or at least, we didn't understand the quite cryptic technical language on their official website...).

Moreover, there was also yet another program that appeared to be similar and installed in the same period called VuuPC.

Does anyone have a clue whether either of these two programs (Sophos or VuuPC) would allow the business partner who installed them to access files and data on my computer (and also if there is any place with clearer information about these programs)?

Also - is there a way to monitor when/whether the programs are being used to access my data? And to see what kind of data they have accessed?

DogBird
  • 1
  • 1
  • A quick search indicates this: Sophos Remote Management appears to be a legitimate part of Sophos, used to manage the Sophos software (perhaps keeping the virus definitions up-to-date or maintaining Sophos across multiple computers on a network); the exact function is unclear. VuuPC is unrelated and there is not much information. One description indicates it is a utility to remotely access a computer (http://vuupc.com/). Other descriptions indicate it is a virus or a mechanism to propagate a virus via your clicking on pop-up ads. If that is the case, you should immediately remove it. – fixer1234 Dec 21 '14 at 00:14
  • VuuPC is the only one you need to be concerned about. The problem is that without the availability of detailed information, it's hard to know whether what you have is a remote access program (which you might be able to monitor), or a virus that can damage your system. You're exposing your system to serious risk by leaving it in place. My recommendation is to run your anti-virus software (try several if the first doesn't recognize it). If it isn't detected, then deal with the implications of a remote access program. Consider the possibility that it may not have come from your partner. – fixer1234 Dec 21 '14 at 20:03

1 Answers1

0

Sophos Remote Management is the program that allows remote management of endpoints from a central server (Sophos Enterprise Console), requiring a network connection on ports 8192 and 8194 (by default) from the endpoint to the Sophos Enterprise Console server.

It doesn't provide any direct way to access files, but can configure the settings for Anti-Virus protection, and control where updates for the Sophos software come from.

It's possible that it was installed automatically due to the way Sophos Anti-Virus was installed (if it was deployed from SEC, or directly from a Sophos Update Manager Installation directory).

If you don't have direct network connectivity with your partner you may not be managed anyway.

As for VuuPC it looks like it is a remote access program, allowing access to files etc.

Douglas Leeder
  • 1,485
  • 9
  • 13