A problem occurred when our devices received the latest update

Question

Every time I opened MS Access 2003, the app crashes with KERNELBASE.dll as the fault module, but when I uninstalled sophos I can open my MS Access files. Here are the further details: 
 Problem Event Name: APPCRASH Application Name: MSACCESS.EXE Application Version: 11.0.5614.0 Application Timestamp: 3f3c8e3c Fault Module Name: KERNELBASE.dll Fault Module Version: 6.1.7601.24545 Fault Module Timestamp: 5e0eb7d0 Exception Code: e06d7363 Exception Offset: 0000845d OS Version: 6.1.7601.2.1.0.256.48 Locale ID: 1033 
 Additional information about the problem: LCID: 1033 Brand: Office11Crash skulcid: 1033 
 Read our privacy statement online: go.microsoft.com/.../ 
 If the online privacy statement is not available, please read our privacy statement offline: C:\Windows\system32\en-US\erofflps.txt

Sophos User930 · Accepted Answer

From the dump I saw reproducing this with Office 2003, the issue is with the Office 2003 version only. Access 2010 opening the same file is fine. 
 The following Sophos DLL: " sophosofficeav.dll" is loaded into a process such as MSAccess.exe as a result of Sophos using the IOfficeAntiVirus interface to get a call back for download reputation scanning. 
 32-bit processes load: "C:\Program Files\Sophos\Sophos Network Threat Protection\IOAV\x86\sophosofficeav.dll" 
 64-bit processes load "C:\Program Files\Sophos\Sophos Network Threat Protection\IOAV\x64\sophosofficeav.dll" 
 I assume the MSAccess.exe you are using is 32-bit given the age. 
 The Scan method IOfficeAntiVirus::Scan method (Windows) | Microsoft Docs in the DLL is passed a MSOAVINFO structure. When passed on 2003 the szOrigURL value of this structure is garbage. MSOAVINFO structure (Windows) | Microsoft Docs which leads to an access violation. 
 Sophos said they can workaround this in the DLL but I guess you can disable Tamper and rename "C:\Program Files\Sophos\Sophos Network Threat Protection\IOAV\x86\sophosofficeav.dll". Next time MSAccess.exe launches, the DLL will not be pulled in.

Qoosh · Answer

Hello Point7, 
 Thank you for reaching out to the Sophos Community. 
 Do you know if exclusions have been added for the process "MSACCESS.exe"? 
 As an initial step, I recommend adding this as a " Process exclusion ", as well as an " Exploit Mitigation Exclusion ".

A problem occurred when our devices received the latest update

Top Replies