Getting Error After New Update (Sophos~1.DLL)

Question

Hello everyone, 
 Today we started receiving errors on a couple of our windows machines, particularly the ones with Windows 7 Installed. 
 The error states 
 Window Title > LogonUI.exe Bad Image 
 Message > C:\Windows\system32\SophosAV\SOPHOS~1.DLL\ is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support. 
 I had an issue were the Sophos UI was all broken on these machines therefore I had to use cmd for Anti Tamper deactivation. 
 The error persists even after reinstalling Sophos, also the installer has been downloaded straight from Sophos Central. 
 Any help would be appreciated. 
 Thanks!

jak · Accepted Answer

Does installing the Microsoft patches help? KBs 4474419 and 4490628 . 
 If the referenced DLL is just the issue, there are a few ways to prevent them loading. They are loaded into processes as they start based on the keys: 
 Native processes, i.e. 64 on 64-bit or 32-bit on 32-bit: 
 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="C:\WINDOWS\system32\SophosAV\SOPHOS~1.DLL" "LoadAppInit_DLLs"=dword:00000001 
 32-bit on 64-bit: 
 [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="C:\WINDOWS\SysWOW64\SophosAV\SOPHOS~1.DLL" "LoadAppInit_DLLs"=dword:00000001 
 The paths are 8.3 and they are essentially here: 
 
 Native - C:\Windows\System32\SophosAV\sophos_detoured_x64.dll 
 32-bit on 64 - C:\Windows\SysWOW64\SophosAV\sophos_detoured.dll 
 
 The LoadAppInit_DLLs DWORD has to be 1 for this technology to work. The Sophos installer does set it if it updates but if you set 
 "LoadAppInit_DLLs"=dword:00000001 to 0 for each, then the DLLs referenced in the AppInit_DLLs key will not get loaded. 
 Of course you could equally remove the Sophos paths in the keys. This would be the case if there were other AppInit DLLs in use. 
 The Sohos installer also has a key, according to 
 https://community.sophos.com/products/sophos-central/f/general/102069/not-able-to-install-sophos-endpoint-after-uninstall 
 64-bit computers: [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\SetupOptions] "DetourDLLState"="excluded" 
 32-bit computers: [HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\SAVService\SetupOptions] "DetourDLLState"="excluded" 
 This will prevent the installer from adding the AppInit DLLs. 
 Of course, some of these will be protected by Tamper Protection but it might give you some options if you fully understand how it becomes to be loaded and installed. 
 The DLL is really only used now for Data Control. 
 Regards, 
 Jak

Shweta · Answer

Hi Can carmack 
 Please follow the steps mentioned in the KB article and install windows KBs 4474419 and 4490628 .

FloSupport · Answer

Updating this thread. Please view the following KBA: 
 
 https://community.sophos.com/kb/en-us/135504