Thread Info
  • State Verified Answer
  • +3 person also asked this people also asked this
  • Locked Locked
  • Replies 113 replies
  • Answers 1 answer
  • Subscribers 24 subscribers
  • Views 19137 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Multiple PCs frozen right after update.

Sophos User5115

Over the last couple weeks, since we received the Core Agent update to 2.19.8 on 10/4, we've had multiple older machines freeze completely.  Screen freezes, no keyboard or mouse, NIC unresponsive.  We have to do a hard shut down to bring them down and back up.  Not positive that this update is the culprit, but on the computers that have been freezing 2 to 3 times a day, we uninstalled Sophos and they've been behaving for a couple days now. 

Models affected:  HP xw4400, HP xw4600, Z400.  All have been running Win10 21H1 with last update back in September.  "Newer" computers (e.g. Z420, Z4 G4) have not had this problem.  Event logs show nothing out of the ordinary around the time of crash.  

Just curious if anybody else has run into this in the last week.    



This thread was automatically locked due to age.
  • 0 in reply to Sophos User930

    None of these functions work to try execute a crash dump when frozen.

  • 0 in reply to Qoosh

    So far with no peripherals, I've been crash-free for 50 hours.  Previously was crashing twice a day.   If good all day, I'll plug peripherals back in tomorrow morning and see if it crashes again.  If it does, I'll use PS2 rather than USB connectors and see if that will make a difference.    

  • 0 in reply to Sophos User5115

    Finally getting somewhere.  Plugged the USB mouse/keyboard into the crashing machine while I Teamviewered into it via laptop, then ran RDP from the crasher to my work computer.  This way I could test mouse and keyboard without monitor hookup.  Within 1 to 2 hours, it crashed.  Now trying PS2 mouse and keyboard to rule things out a little further.   Anybody else testing, can try disabling their USB monitoring to see if that fixes anything also. 

  • 0 in reply to Vman

    reviewing the documentation that doesn't appear necessary to me but maybe I am reading them wrong.

  • 0 in reply to Tim Ingraham1

    C:\  will exclude all files and folders under C:  

    You can just enter C: and it will exclude the drive.

  • 0 in reply to Sophos User5115

    Thank you for the feedback, I will be sharing this information with our Support teams to further their investigation. 

    As a temporary workaround, could you try disabling the following protection feature on the affected devices? Let me know if this prevents the system crashes from occurring.

    I am following cases internally and will follow up here as more information becomes available. 

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0 in reply to Qoosh

    Hi Qoosh

    We have tried to disable "Detect malicious behavior" but still crash. 

  • 0 in reply to Sam Chen

    Thank you for sharing your findings. I will let you know here if a fix or another workaround is found.

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0 in reply to Sophos User5115

    We have found Disabling Endpoint Defense by stopping service and renaming the .sys file corrects the lockup problem but the HitmanPro and A-V settings are irrelevant.

    trying to execute a memory dump does not work with keyboard or power switch as per the MS regkeys.

  • 0 in reply to Qoosh

    Still crashing with PS2 connection.  Here's what I have found so far.  
    1.  All connections (monitor, KB, mouse, power, NIC), PC full use, full Sophos:  Crash twice a day around noon and 5 p.m.
    2.  All connections (monitor, KB, mouse, power, NIC), PC full use, Live file scanning turned off  in Sophos:  No crash.
    3.  No connections except power and NIC, PC idle:  No crash - tested 1 week+
    4.  All connections, PC as RDP client:  Crash twice a day same times as #1. 
    5.  No connections except power and NIC, PC as RDP client:  No crash - tested 50 hours+
    6.  No monitor connection, connected by USB mouse/KB, NIC, power, PC as RDP client:  Crash as #1.
    7.  Connections (PS2 KB, mouse, monitor, NIC, power), PC as RDP client:  Crash. 

    All in all, it seems like having the keyboard and mouse directly connected is causing the issue.  I can try connecting one or the other and narrow it down further, but I would think Sophos would have something worked out by now.  Don't they have a detailed programming change log from the bad update?  Something that they can look at and say, "hey, we changed this feature and now computers are crashing when peripherals are connected, lets roll it back and re-update."  It's been over a month now.   

Unfiltered HTML