This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Endpoint & InterceptX - causing Internet Explorer to crash

Hello,

My company have recently pushed out Sophos Endpoint version 11.5.4 along with InterceptX to a large number of Windows 7 (64bit) computers. The deployment largely went well, but since the installation, we've had a surge of users reporting issues with Internet Explorer crashing or behaving erratically...

Having checked the event logs from a couple of computers these symptoms have been reported on - there appears to be similar errors as below:

"The program IEXPLORE.EXE version 11.0.9600.18618 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 1c98
Start Time: 01d2c4b4f9457e62
Termination Time: 16
Application Path: C:\Program Files\Internet Explorer\IEXPLORE.EXE
Report Id: 6978f697-30b7-11e7-89cd-ac162d110386"

Having uninstalled Sophos from two of these machines and asked the users to monitor IE behaviour for a couple of days - they no longer had these issues. Has anyone else had similar problems and if so, what did you do to fix?

Thank you for any assistance anyone can provide.

This thread was automatically locked due to age.

Simon Waddingham over 7 years ago

Is nobody else experiencing these issues?
Cancel
Vote Up 0 Vote Down

Cancel
Mike Therrien over 7 years ago

Yes I am having the same issue. I am not getting an logs but IE is opening with a white screen and then closing. With in the task manager it show IE not responding. I tried to open a case but could not reproduce the problem when the tech was connected. I think it might have something to do with the windsock. When there is an active connection to the internet it doesn't happen. I took a video with my cell phone and sent it to sophos to create a case.
Cancel
Vote Up 0 Vote Down

Cancel
jak over 7 years ago in reply to Mike Therrien

I would suggest following the guidance in this post:
https://community.sophos.com/products/endpoint-security-control/f/sophos-endpoint-software/86219/software-hangs-with-endpoint-installed

I.e. prevent IE from loading Sophos detours. If that helps, having disabled it on a couple of computers for a few days, getting a full dump of the IE process in the hung state would be the next step.

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
Simon Waddingham over 7 years ago in reply to jak

Hello jak, I shall attempt this on a few users workstations that have reported these problems and report back. Thanks for your response.
Cancel
Vote Up 0 Vote Down

Cancel
Ichbins over 7 years ago

Same Issue on my private (and Business) machine.
A new installed Windows 10 Machines (up to date).
Only the InterceptX installed.

After this: not possible to open PDF, Word, Excel... also some hangs on online gaming.
Removed Intercept-X all was fine.

No reports in Sophos Central, no Logs to find why Word (for example) is blocked. NO "action" in Intercept X.
Downloades the Testfile: oh... there is a message! Nice, it works. But not for Standardprograms?

The only way i found was to use the Configuration in Sophos Central: Exploit Mitigation Exclusions

But(!): this is a global configuration, for ALL Clients? Really?
And my questin is: when i use this exception, the whole protection is disabled for all Word Applications in my environment?
No, i can't believe it. But i found no better configuration.

Is there no way to exclude only ONE File (Java App) for ONE Computer?

Sorry... thats not practicable..
Cancel
Vote Up 0 Vote Down

Cancel
Louis-M over 7 years ago in reply to Ichbins

Sorry to butt in here..... Sophos endpoint & intercept X. Is this the "exploit protection" that is in Sophos enterprise console or both individual products?
Cancel
Vote Up 0 Vote Down

Cancel
Ichbins over 7 years ago in reply to Louis-M

Hi Louis,

i only use the Intercept X Feature (Sophos Cloud managed).
For AV i use another Program.
Cancel
Vote Up 0 Vote Down

Cancel
jak over 7 years ago in reply to Ichbins

What is the other security application? There is a good chance there is a conflict.
Cancel
Vote Up 0 Vote Down

Cancel
Simon Waddingham over 7 years ago in reply to Simon Waddingham

Performing the following registry changes seems to help with the issue:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\
LoadAppInit_DLLs = 0

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows
LoadAppInit_DLLs = 0

I've tested this with around 5 users and immediately all noticed a difference. I have a case open with Sophos Tech Support so will run the iexplore dump and forward it onto them as per Jak's post here:

https://community.sophos.com/products/endpoint-security-control/f/sophos-endpoint-software/86219/software-hangs-with-endpoint-installed

Thanks for this Jak.
Cancel
Vote Up 0 Vote Down

Cancel
jak over 7 years ago in reply to Simon Waddingham

No problem, glad it's narrowed it down a little.

To disable detours being re-registered in the future on an update there are these keys that can be created"

64-bit computers:
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\SetupOptions]
"DetourDLLState"="excluded"

32-bit computers:
[HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\SAVService\SetupOptions]
"DetourDLLState"="excluded"

With this in place, the SAV installer will not attempt to re-register the Appinit dll.

Note: they are strings.

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel