Sophos UTM: Decommissioning of obsolete URL categorization services CFFS. Click here for important info.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 12 subscribers
  • Views 1590 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophosdiag.exe / Endpoint Self Help crashing when loading

xDrone

Good afternoon,

Having an issue on one of our RDS servers where I'm trying to load up the Endpoint Self Help program (sophosdiag.exe) to check over some communication management settings. However when loading either through the program or via the Endpoint Agent. It loads half of the module and crashes out, doesn't even load up at all when trying to run as administrator.

The following errors come up within Event Viewer when this happens. Is there a way to fix this?

I've ran SFC scannow and dism tools, tried different users and admin accounts. All the same. The following errors come through in Event viewer immediately after crashing.

Faulting application name: SophosDiag.exe, version: 3.1.88.0, time stamp: 0x6144c172
Faulting module name: wuapi.dll, version: 7.9.9600.19915, time stamp: 0x5fd8344b
Exception code: 0xc0000005
Fault offset: 0x000000000006069e
Faulting process ID: 0x729c
Faulting application start time: 0x01d8070a82c99a2b
Faulting application path: C:\Program Files\Sophos\Endpoint Self Help\SophosDiag.exe
Faulting module path: C:\Windows\System32\wuapi.dll

And 

Application: SophosDiag.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.AccessViolationException



This thread was automatically locked due to age.
  • 0

    Given the module referenced is wuapi.dll, which is the Windows Update Client API. I suspect it's due to enumerating the installed patches which SophosDiag does display.

    If you stop and disable the Windows Update service it might confirm that, I assume then it might load as it handles this:

    Beyond that I would try and get a process dump of SophosDiag.exe when it crashes.  Easiest way is to download Procdump (ProcDump - Windows Sysinternals | Microsoft Docs) from Sysinternals/Microsoft to say:

    C:\dumps\

    From an admin prompt run:

    C:\dumps\procdump.exe -ma -i C:\dumps

    launch the SophosDiag,exe so it crashes and you should then have 1, possibly 2 dump files.  Only the first is required.

    You can run:

    C:\dumps\procdump.exe -u

    to remove the registration as the post-mortem debugger once you have the dump file.

    Maybe send it to Support or link it here.

    Regards,

  • 0 in reply to Sophos User930

    If you open up a PowerShell ISE Window, paste the following:

    $updateSession = New-Object -ComObject 'Microsoft.Update.Session'
$updateSearcher = $updateSession.CreateUpdateSearcher()
$searchResult = $updateSearcher.Search('IsInstalled=1 and IsHidden=0')
foreach ($update in $searchResult.Updates) { $update.Title }

    Does it list the title of installed patches or does it error when you run it?

  • 0 in reply to Sophos User930

    Hi there, Thank you so much for replying and helping. I ran the Powershell ISE script and all updates listed fine, same issue occurred when stopping the Windows Update Service too. I've ran the results of the dmp file and pasted it below. Hopefully that gives some information that you might know instantly or whether I need to log this with support?

    Many thanks :) 

    https://pastebin.com/XNNv9UpL

  • 0 in reply to xDrone

    When you say:

    "Same issue occurred when stopping the Windows Update Service too".  Is this ESH process crashing?  Did that include disabling the service and stopping it?

  • 0 in reply to Sophos User930

    Hi, Yes I stopped within services.msc then tried to reload ESH. All processes half way loaded again and crashed without warning. So no difference with the service Stopped or Started.

  • 0 in reply to xDrone

    But was the Windows Update service stopped AND disabled.  My concern was if the service is started by the COM call from ESH and then fails.  If the service is disabled it cannot start.

Unfiltered HTML