Thread Info
  • State Suggested Answer
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 19 subscribers
  • Views 1822 views
  • Users 0 members are here
Options
Suggested

Blue Screen of Death | SophosNtpService | Windows Updates March 2024

Wayne H

I posted this as a reply on a different thread, but it seems to have not gotten any attention, so I am posting it now as an independent thread.

I am experiencing on multiple machines with Sophos Home installed, the following:

Quasi-random BSOD (tcpip.sys) when browsing certain web pages (using MS Edge).

I have figured out the contributing factors to be:

  1. Recent Windows (March 2024) "quality" updates.
  2. Sophos Home installed.
  3. Virtual Machines (network drivers are in the mix).

Additionally, I am running these virtual machines on ESXi7 and it affects both Windows 10 and Windows 11.

Before writing this post, I tried:

  1. Upgrading ESXi7 to the latest (March 2024) update: 7.0-U3p.
  2. Updating virtual NIC drivers.
  3. Changing type of virtual NICs (e.g., E1000e to VMXNET3).
  4. Removing the March 2024 Windows updates (only a temporary measure).

After reviewing the crash dumps, I obtained the following information that points to a conflict between Sophos and something else.

  • PROCESS_NAME: SophosNtpServi
  • FAILURE_BUCKET_ID: AV_vmxnet3!unknown_function

I confirmed that un-installing Sophos Home prevents the problem from occurring.

I further confirmed, immediately before making this new post, that the issue still exists after updating Sophos.

I am able to provide crash dumps if needed.

Parents Reply
  • 0 in reply to Gladys

    Hi Gladys,

    I have a work around which is to remove Sophos (and ultimately try to find another vendor if it's not eventually resolved). That works for me since it only appears to affect VMware based virtual machines (though I suspect this use case comes up quite a bit in the business world).

    I was merely reporting the issue to Sophos. I have logged into my Sophos Home account and created a ticket there that just duplicates the same information. I have now reported the same issue three times. I really don't care what happens now. You may use the information to improve your product, or you may choose to ignore it. I have done my part to try to help.

    Regards,

    Wayne.

Children
Unfiltered HTML