Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 1 subscriber
  • Views 4770 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Any problem after install sophos 9.5 into SQL Server 2000 SERVER

yh

Hello,

Recently found some applicaiton server with SQL Server 2000 got problem. Some task could not start. Original database application could not access normally.

Any one encountered.

Thanks

:10539


This thread was automatically locked due to age.
  • 0

    Hi,

    I have a few things for you to try and test.  Firstly have you made any exclusions on the machine as per:
    http://support.microsoft.com/kb/309422/

    If things still are quite as they should be, the other components of SAV that could interfere on a process level would be:

    You could try disabling detours and then the LSP and see if things change?

    To disable Detours open the keys:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
    and
    HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
    if running on a 64 bit test machine and remove the entry to load the Sophos detours dll.  
    Please back up the keys before doing so or copy of the paths to the Sophos DLLs in both places so they can be added back later.  Reboot.  If this helps I would get in touch with Support.  Please note removing the keys in this way is a temporary test, to ensure that the entries are not put back on update you need to create a string reg value:
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Sophos\SAVService\SetupOptions]
    "DetourDLLState"="excluded"
    Note: Adjust path for 32bit.
    To disable the LSP, if you turn off the "web protection" feature in SAV and then reboot, does it help?

    Both of these components load into processes so once configured to be off or startup points are removed, the processes would need to be restarted, to ensure that the component is not loaded, for that reason a reboot is suggested.  If you think the problem is with detours and the SQL service specifically, you could try removing the detours registry keys and then restarting the SQL service but this will just remove detours from this one process and future processes created.

    I hope this helps you to narrow down the problem.

    Regards,

    Jak

    :10551
  • 0

    Thank you jak

    There are no exclusions on two sql server.Before do your steps. I will double confirm you.

    1. Disable means remove path under AppInit_DLLs (C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL), right?

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
    and
    HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs

    2. What's sophos doing after disable this?

    3. What's LSP?  Where to disable the LSP in Sophos?

    For childserver log I posted before, I found the error and solved it. I found sql one table, log inside is wrongly, so no update.

    B.Regards,

    :10645
  • 0

    1. Yes, as a test removing the paths to the sophos dll in the registry keys mentioned.  Removing the entries and rebooting will rule out Detours.  The other DetourDLLState key can be used to make the possible workaround more permanent.  The first test is just to see if it helps.

    2. Detours is used to implement the features here:
    http://www.sophos.com/support/knowledgebase/article/112099.html

    i.e. data control, bops, to launch the BHO into IE process to ensure the first page is scanned.

    I doubt you have data control enabled on the server.  I wouldn't imagine much browsing of the internet goes on from the SQL Server and if you set your homepage to "blank" your covered as the BHO will still be loaded by IE to scan the next page.  Maybe the OS implements buffer overflow protection and Sophos BOPS is disabled for this machine anyway?

    3.The LSP is the component that implements the web protection filter.  Under "Configure - Anti-virus - web protection"

    Again, it's a restart to disable this one.


    Hope you can figure out the component maybe causing the problem.


    Jak

    :10647
  • 0

    Hi, Jak

    I found original server with sql 2000, after install sophos, definitily got problem. Some original server with sql sv 2005 and 2008, after install sophos , no this issue.

    Actually, i had removed sophos from some sql 2000 server. After uninstall, some schedule task still could not run automatically.

    Do you know how to fully clear Sophos in the sql 2000 server to make sure schedule task run as normal as before

    THANKS&B.Regards

    :11621
  • 0

    HI,

    It's very unlikely Sophos is preventing the tasks running.  Unless they are running viruses. :)

    What errrors do you get when you try and schedule or run a task?

    It's more likely to be something like:
    http://support.microsoft.com/kb/246183

    or

    Error message when you run an old scheduled task or a newly created scheduled task on a Windows Server 2003 Service Pack 2-based domain controller: "0x8007000d: The data is invalid"
    http://support.microsoft.com/kb/958837/en-us
     
    "The attempt to retrieve account information for the specified task failed" error message when you use Task Scheduler to schedule volume shadow copy to run in Windows Server 2003
    http://support.microsoft.com/kb/822904/en-us
     
    Task Scheduler returns a "HRESULT: 0x8007007A" error message after you save many jobs
    http://support.microsoft.com/kb/264522/en-us
    Problems if the Cryptography Subsystem Is Damaged

    Error message when you run an old scheduled task or a newly created scheduled task on a Windows Server 2003 Service Pack 2-based domain controller: "0x8007000d: The data is invalid

    http://support.microsoft.com/kb/958837/en-us 

    Jak

    :11631
  • 0

    Hi, Jak

    Thank you for your reply.

    The error message from SQL log showed that the schedular 1 appears to be hung, spid 0, ecid 0, UMS Context.... Error: 17883, severity 1, state 0

    I checked error 17883, need updated latest patches. But this sql server had updated to the latest one.

    This error happened after installing sophos, even uninstall sophos, but schedule task still could not start automatically.

    :11735
Unfiltered HTML