Over the last couple weeks, since we received the Core Agent update to 2.19.8 on 10/4, we've had multiple older machines freeze completely. Screen freezes, no keyboard or mouse, NIC unresponsive. We have to do a hard shut down to bring them down and back up. Not positive that this update is the culprit, but on the computers that have been freezing 2 to 3 times a day, we uninstalled Sophos and they've been behaving for a couple days now.
Models affected: HP xw4400, HP xw4600, Z400. All have been running Win10 21H1 with last update back in September. "Newer" computers (e.g. Z420, Z4 G4) have not had this problem. Event logs show nothing out of the ordinary around the time of crash.
Just curious if anybody else has run into this in the last week.
If anyone is still having the issue, I suspect the issue is with some form of memory scanning.
If you use Process Hacker to inspect the memory (memory tab) of the audiodg,exe process, regardless of Sophos…
[Update - Nov 16] This issue has been escalated and is being investigated internally under reference ID: WINEP-37251We will update this post with additional updates as they become available.
Thank you for reaching out to the Sophos Community.
If you were looking to troubleshoot this issue a bit further, I'd recommend trying to perform some feature isolation to see if we can narrow down what components may be playing a part in things.
As it seems the issues take some time to emerge, you may want to interact with the drivers on the affected device(s). I recommend only doing one of the following components at a time and observing the device as the day goes on to see if this improves the results you’re getting.
HMPA Isolation:a) Access the Services and stop then disable the following service:HitmanPro.Alert serviceb) Access the following folder: C:\Windows\System32\c) Rename hmpalert.dll to hmpalert.origd) Access the following folder: C:\Windows\SysWOW64\e) Rename hmpalert.dll to hmpalert.origf) Reboot the device
SAV Isolation:a) Access the Services and stop then disable the following service: Sophos Anti-Virus b) Reboot the device
Sophos Endpoint Defense Isolation:a) Access the following folder: C:\Windows\System32\drivers\b) Rename SophosED.sys to SophosED.sys.origc) Reboot the device
Let me know what your findings are by updating this thread and we can advise further based on the results.
So far with no peripherals, I've been crash-free for 50 hours. Previously was crashing twice a day. If good all day, I'll plug peripherals back in tomorrow morning and see if it crashes again. If it does, I'll use PS2 rather than USB connectors and see if that will make a difference.
Thank you for the feedback, I will be sharing this information with our Support teams to further their investigation.
As a temporary workaround, could you try disabling the following protection feature on the affected devices? Let me know if this prevents the system crashes from occurring.
I am following cases internally and will follow up here as more information becomes available.
We have tried to disable "Detect malicious behavior" but still crash.
Thank you for sharing your findings. I will let you know here if a fix or another workaround is found.
Still crashing with PS2 connection. Here's what I have found so far. 1. All connections (monitor, KB, mouse, power, NIC), PC full use, full Sophos: Crash twice a day around noon and 5 p.m.2. All connections (monitor, KB, mouse, power, NIC), PC full use, Live file scanning turned off in Sophos: No crash.3. No connections except power and NIC, PC idle: No crash - tested 1 week+4. All connections, PC as RDP client: Crash twice a day same times as #1. 5. No connections except power and NIC, PC as RDP client: No crash - tested 50 hours+6. No monitor connection, connected by USB mouse/KB, NIC, power, PC as RDP client: Crash as #1.7. Connections (PS2 KB, mouse, monitor, NIC, power), PC as RDP client: Crash.
All in all, it seems like having the keyboard and mouse directly connected is causing the issue. I can try connecting one or the other and narrow it down further, but I would think Sophos would have something worked out by now. Don't they have a detailed programming change log from the bad update? Something that they can look at and say, "hey, we changed this feature and now computers are crashing when peripherals are connected, lets roll it back and re-update." It's been over a month now.
You're not alone, very frustrating that there are no real solutions yet.