Multiple PCs frozen right after update.

Over the last couple weeks, since we received the Core Agent update to 2.19.8 on 10/4, we've had multiple older machines freeze completely.  Screen freezes, no keyboard or mouse, NIC unresponsive.  We have to do a hard shut down to bring them down and back up.  Not positive that this update is the culprit, but on the computers that have been freezing 2 to 3 times a day, we uninstalled Sophos and they've been behaving for a couple days now. 

Models affected:  HP xw4400, HP xw4600, Z400.  All have been running Win10 21H1 with last update back in September.  "Newer" computers (e.g. Z420, Z4 G4) have not had this problem.  Event logs show nothing out of the ordinary around the time of crash.  

Just curious if anybody else has run into this in the last week.    



[Update - Nov 23] The following KBA has been published regarding this issue - https://support.sophos.com/support/s/article/KB-000043418?language=en_US
[edited by: Qoosh at 8:41 PM (GMT -8) on 23 Nov 2021]
Parents
  • [Update - Nov 16] This issue has been escalated and is being investigated internally under reference ID: WINEP-37251
    We will update this post with additional updates as they become available.


    Hello,

    Thank you for reaching out to the Sophos Community. 

    If you were looking to troubleshoot this issue a bit further, I'd recommend trying to perform some feature isolation to see if we can narrow down what components may be playing a part in things. 

    As it seems the issues take some time to emerge, you may want to interact with the drivers on the affected device(s). I recommend only doing one of the following components at a time and observing the device as the day goes on to see if this improves the results you’re getting.

    HMPA Isolation:
    a) Access the Services and stop then disable the following service:HitmanPro.Alert service
    b) Access the following folder: C:\Windows\System32\
    c) Rename hmpalert.dll to hmpalert.orig
    d) Access the following folder: C:\Windows\SysWOW64\
    e) Rename hmpalert.dll to hmpalert.orig
    f) Reboot the device

    SAV Isolation:
    a) Access the Services and stop then disable the following service: Sophos Anti-Virus 
    b) Reboot the device

    Sophos Endpoint Defense Isolation:
    a) Access the following folder: C:\Windows\System32\drivers\
    b) Rename SophosED.sys to SophosED.sys.orig
    c) Reboot the device

    Let me know what your findings are by updating this thread and we can advise further based on the results.

    Kushal Lakhan
    Global Community Support Engineer
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
  • So far with no peripherals, I've been crash-free for 50 hours.  Previously was crashing twice a day.   If good all day, I'll plug peripherals back in tomorrow morning and see if it crashes again.  If it does, I'll use PS2 rather than USB connectors and see if that will make a difference.    

  • Thank you for the feedback, I will be sharing this information with our Support teams to further their investigation. 

    As a temporary workaround, could you try disabling the following protection feature on the affected devices? Let me know if this prevents the system crashes from occurring.

    I am following cases internally and will follow up here as more information becomes available. 

    Kushal Lakhan
    Global Community Support Engineer
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
Reply Children
  • Hi Qoosh

    We have tried to disable "Detect malicious behavior" but still crash. 

  • Thank you for sharing your findings. I will let you know here if a fix or another workaround is found.

    Kushal Lakhan
    Global Community Support Engineer
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
  • Still crashing with PS2 connection.  Here's what I have found so far.  
    1.  All connections (monitor, KB, mouse, power, NIC), PC full use, full Sophos:  Crash twice a day around noon and 5 p.m.
    2.  All connections (monitor, KB, mouse, power, NIC), PC full use, Live file scanning turned off  in Sophos:  No crash.
    3.  No connections except power and NIC, PC idle:  No crash - tested 1 week+
    4.  All connections, PC as RDP client:  Crash twice a day same times as #1. 
    5.  No connections except power and NIC, PC as RDP client:  No crash - tested 50 hours+
    6.  No monitor connection, connected by USB mouse/KB, NIC, power, PC as RDP client:  Crash as #1.
    7.  Connections (PS2 KB, mouse, monitor, NIC, power), PC as RDP client:  Crash. 

    All in all, it seems like having the keyboard and mouse directly connected is causing the issue.  I can try connecting one or the other and narrow it down further, but I would think Sophos would have something worked out by now.  Don't they have a detailed programming change log from the bad update?  Something that they can look at and say, "hey, we changed this feature and now computers are crashing when peripherals are connected, lets roll it back and re-update."  It's been over a month now.   

  • You're not alone, very frustrating that there are no real solutions yet.