Thread Info
  • State Verified Answer
  • +3 person also asked this people also asked this
  • Locked Locked
  • Replies 113 replies
  • Answers 1 answer
  • Subscribers 24 subscribers
  • Views 19151 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Multiple PCs frozen right after update.

Sophos User5115

Over the last couple weeks, since we received the Core Agent update to 2.19.8 on 10/4, we've had multiple older machines freeze completely.  Screen freezes, no keyboard or mouse, NIC unresponsive.  We have to do a hard shut down to bring them down and back up.  Not positive that this update is the culprit, but on the computers that have been freezing 2 to 3 times a day, we uninstalled Sophos and they've been behaving for a couple days now. 

Models affected:  HP xw4400, HP xw4600, Z400.  All have been running Win10 21H1 with last update back in September.  "Newer" computers (e.g. Z420, Z4 G4) have not had this problem.  Event logs show nothing out of the ordinary around the time of crash.  

Just curious if anybody else has run into this in the last week.    



This thread was automatically locked due to age.
Parents
  • 0

    We are having the same issue with HP 6000 Pro SFF with Intel Nics. About 48 computers with the issue since October.

  • 0 in reply to Vman

    We have narrowed it down.

    Disabling Endpoint Defense by renaming the .sys file corrects the lockup problem but the HitmanPro and A-V settings are irrelevant

  • 0 in reply to Vman

    Vman, which file of type .sys are you referring to?  Sophos rep had me rename hmpalert.sys and savonaccess.sys. But the rename didn't solve the issue.

  • 0 in reply to Ronald Woods

    Disable Tamper Protection

    Note: a Sophos update will add the file back and enable the service.

    Sophos Endpoint Defense Isolation:
    a) Access the following folder: C:\Windows\System32\drivers\
    b) Rename SophosED.sys to SophosED.sys.orig
    c) Reboot the device

    System we have done this are stable.

    Sophos Support is jsut capturing SDU's with no action.

    we have submitted almost 10 SDU's and with verbose logging and still nothing from Sophos Support.

  • 0 in reply to Vman

    Whenever I did this, it just recreated the SophosED.sys and didn't solve anything.   I ended up going to the cloud management and made a policy with the file scanning turned off and just put the problem PCs in that group.  

  • 0 in reply to Sophos User5115

    Just to confirm? 

    Cloud portal - > Endpoint Protection - Policies -> Threat Protection -> new policy with computer - turn off

    "Real-time Scanning - Local Files and Network Shares"


     

  • 0 in reply to Vman

    Interesting, I'm running Intercept X with Endpoint advanced. I renamed SophosED.sys to SophosED.orig not SophosED.sys.orig and rebooted. The file did not reappear to the sys state but I did get the error messages, Sophos IPS and Sophos System Protection Services stopped.  I'm running the music tests for 3 + hours now to see if that "fixes" the issue of freezing. That is NOT a solution to Sophos S/W design!!!  Actually, it's really a Microsoft issue, as I commented on in an earlier (10:41 PST) post (below). Since the March 2021 Windows updates, things have gone FUBAR with Sophos. By NOT updating to the latest Win updates after March 2021 or May 2021, I have no problem playing music for 12 hours continuously and running Sophos. So MS stuffed something up really good. One MS MVP consultant stated, with the older PCs and MS updates continuing, it's only going to get worse!"  When I run stuff on my new Vostro 5510 laptop and Optiplex 5090 MT running Windows 10 Pro and have NO problem. Maybe something with the drivers that Dell NO LONGER supports on these older PCs! 

Reply
  • 0 in reply to Vman

    Interesting, I'm running Intercept X with Endpoint advanced. I renamed SophosED.sys to SophosED.orig not SophosED.sys.orig and rebooted. The file did not reappear to the sys state but I did get the error messages, Sophos IPS and Sophos System Protection Services stopped.  I'm running the music tests for 3 + hours now to see if that "fixes" the issue of freezing. That is NOT a solution to Sophos S/W design!!!  Actually, it's really a Microsoft issue, as I commented on in an earlier (10:41 PST) post (below). Since the March 2021 Windows updates, things have gone FUBAR with Sophos. By NOT updating to the latest Win updates after March 2021 or May 2021, I have no problem playing music for 12 hours continuously and running Sophos. So MS stuffed something up really good. One MS MVP consultant stated, with the older PCs and MS updates continuing, it's only going to get worse!"  When I run stuff on my new Vostro 5510 laptop and Optiplex 5090 MT running Windows 10 Pro and have NO problem. Maybe something with the drivers that Dell NO LONGER supports on these older PCs! 

Children
No Data
Unfiltered HTML