Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 2 replies
  • Answers 1 answer
  • Subscribers 14 subscribers
  • Views 14135 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Intercept X module on Sophos Endpoint Cloud's client don't give logs

Yasin Aydın

 There is an app at my pc. It works seamlessly on my pc and other pcs. And It also runs  when I installed only endpoint advanced module. But when I want to install intercept module, it is preventing from my app's works. And there is no log for this situation from sophos sides. Is there anybody who have similar problem?



This thread was automatically locked due to age.
Parents
  • +1

    Hi,

    If you rename:

    C:\windows\system32\hmpalert.dll to say: C:\windows\system32\hmpalert.dll.rename

    and relaunch the application does it work?  I wonder if the issue is with the injected DLL?

    Note: if it's a 32-bit application on a 64-bit computer then it would be the file: C:\windows\syswow64\hmpalert.dll you would need to rename.

    Otherwise, the next test would be to disable the hmpalert driver by setting the start value under:
    hklm\system\currentcontrolset\hmpalert

    from 3 (default) to 4 (disabled) and reboot.

    I wonder if the issue is with the driver or the user mode DLL.

    Regards,

    Jak

Reply
  • +1

    Hi,

    If you rename:

    C:\windows\system32\hmpalert.dll to say: C:\windows\system32\hmpalert.dll.rename

    and relaunch the application does it work?  I wonder if the issue is with the injected DLL?

    Note: if it's a 32-bit application on a 64-bit computer then it would be the file: C:\windows\syswow64\hmpalert.dll you would need to rename.

    Otherwise, the next test would be to disable the hmpalert driver by setting the start value under:
    hklm\system\currentcontrolset\hmpalert

    from 3 (default) to 4 (disabled) and reboot.

    I wonder if the issue is with the driver or the user mode DLL.

    Regards,

    Jak

Children
Unfiltered HTML