****This is an email****
David,

Sophos has investigated the files and done some
changes to the definitions.

Could you attempt to run your program and let me
know the results?

Thanks,

Uploaded samples to Sophos

****This is an email****
Hello, Brian.

Thank you for contacting Sophos Technical Support.

If by "ignore", you mean that you tried to exclude
the files from scanning, that will not work for
suspicious detections, as this is HIPS
functionality (you can only exclude files from
on-access or scheduled scanning. To be clear,
non-HIPS detected files in these sections.). When
you tried to authorize the files, did you do so in
the Sophos client itself or in the anti-virus and
HIPS policy in the console? It could be that it
did not properly propagate from the policy to the
client, or then the local settings were soon
overwritten by the policy.

To that end, I would definitely suggest making the
change to a test policy and then applying said
policy to a test group where you put the affected
client, then also making the change locally, that
way you're sure that these settings are sticking.

What you should also do is send a sample of the
files in question to our labs for analysis, that
way we can confirm whether or not they're actually
malicious. Instructions in the KBA below:

http://www.sophos.com/support/knowledgebase/article/11490.html


Should you require further support, please provide
us with your Sophos license number.

Please also let me know the Sophos and operating
system versions.

Task reassigned to Brian Berkley.

Task reassigned to Nathan Higginbotham.

Priority changed from (3) Priority to (2) High Priority.

He had software that we came and loaded for him 
because we had to get into admin access. It had 
been working fine. Now when he clicks on the 
desktop icon something pops up saying its a 
suspisious file and it won't allow him to use it.