Sophos AutoUpdate

Sophos AutoUpdate is a Windows updater program that operates as a background service. It automatically launches upon system boot and checks for updates based on user settings, downloading and installing them as necessary. The AutoUpdate service, run as 'System User', initially performs an update check to the CID and runs a scheduler for scheduled updates. It also provides an interface for initiating updates. ALUpdate.exe is responsible for connecting to the network and downloading files, running during updates as the system user and impersonating the local SophosSAU account. When called, it runs with specific parameters. Additionally, ALMon.exe is a DCOM server that enables Sophos Anti-Virus to display virus alerts on the user desktop. It is launched from the ‘All Users’ Start-up menu and runs as the logged on user name. For further details on user accounts/groups, refer to the ‘Significant accounts/groups’ section.