This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Auto-Updates are causing Laptop to Freeze

I have been having a problem for a couple of months, which is now getting worse, related to Sophos auto-updating.

Sometimes when it is updating the computer will freeze for 5min to several hours (it is currently doing the latter):
- usually the first sign is that firefox or thunderbird will say not responding and grey out slightly
- then in some sequence other programs will say not responding (in the beginning part of this problem I can use other programs like Excel)
- Task Manager will not open
- sometimes after long pauses there will be responses to previous clicks (an excel file will be saved for example)
- during this, the mouse *is* responsive and I can typically toggle between open windows using Alt-Tab
- the clock sometimes stops updating part way through
- every time this happens Sophos is in the process of updating
- eventually the freeze stops and (most of the time) the computer functions normally.

I have run literally a dozen virus checks and that is not an issue.

There is a consistent set of lines in Windows Event Viewer which occur just as the updating troubles begin:

Error 6/14/2012 12:43:25 PM SAVOnAccess 81 None " The on-access scan of file ""\Device\HarddiskVolume1\ProgramData\Sophos Web Intelligence\s ..."" of process mbamservice.ex, start check timestamp [ 1cd4a53cd486cc1] did not complete in time: file was not scanned.
"
OR
Error 6/13/2012 1:24:59 PM SAVOnAccess 81 None " The on-access scan of file ""\Device\HarddiskVolume1\ProgramData\Sophos Web Intelligence\s ..."" of process mbamservice.ex, start check timestamp [ 1cd499071ed829f] did not complete in time: file was not scanned.

This suggests a conflict between Sophos and Malwarebytes Anti-Malware. However the problem persists even when:

- I have turned off MAM (turned off real time protection)

- excluded Malwarebytes folders (c:\programdata\malwarebytes AND c:\ proram files (x86)\malwarebytes' anti-malware) from sophos' scanning

I also have other lines related to Firefix and Thunderbird in the Event Viewer. I have added exclusions to these folders as well in Sophos.

At this point I have given up and turned off auto-updating all together.

If anyone has any suggestions on what might be going I would greatly appreciate it!


My machine:
Dell Latitude E6320
Win 7 Enterprise x64
Sophos Endpoint Security and Control version 9.5
Windows Firewall On
No other Antivirus/Firewall programs installed (I previously had malwarebytes installed but have disabled it and the problem persists: see above)

PS I did see a related thread, /search?q= 1043 , but am not sure how this was resolved.

:25955


This thread was automatically locked due to age.
Parents
  • Hi,

    It sounds like a deadlock based on the time it hangs for and the event log entries you see.

    Are you able to remove Malwarebytes completely and reboot and wait for the next update to see if it hangs. 

    It might be worth updating the endpoint to the latest version of SAV if you are able also, 10.0.5 is the latest but I would start by removing Malwarebytes as it would be a quick test.  Typically turning off realtime scanning doesn't disable the file system filter drivers.

    Regards,

    Jak

    :25957
Reply
  • Hi,

    It sounds like a deadlock based on the time it hangs for and the event log entries you see.

    Are you able to remove Malwarebytes completely and reboot and wait for the next update to see if it hangs. 

    It might be worth updating the endpoint to the latest version of SAV if you are able also, 10.0.5 is the latest but I would start by removing Malwarebytes as it would be a quick test.  Typically turning off realtime scanning doesn't disable the file system filter drivers.

    Regards,

    Jak

    :25957
Children
No Data