This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Problems with MS KB2393802 and Sophos A/V

I have Sophos A/V 9.5 running on Win7 x64. A recent windows update (KB2393802) caused the scheduled daily scan to hang at 100% CPU. If I run it manually, it never gets past the memory scan - although there are errors in the event log to the effect that a connection has been lost to the Sophos Progress dialog so that may not be the real story.

Googling KB2393802 suggests that this update is causing lots of problems but I haven't seen any reference to Sophos. Just wondered if anyone else is having this problem?

:9287


This thread was automatically locked due to age.
  • I just launched a full system scan on my fully-patched Windows 7 x64 VM (including KB2393802). The memory scan took about five seconds to complete before the rootkit scan began. So here are some questions for you:

    • How many machines do you have that are affected by this issue?
    • Are you certain it was KB2393802 that caused the trouble?
      (Were your scans working, you installed only the KB2393802 patch by itself, then noticed the issue?)
    • Does removing the KB2393802 patch resolve the issue?
    • Are there other outstanding patches (some of which may potentially resolve issues in earlier patches)?

    If you can't track this one down, do engage Support – preferably with the output of the Sophos Diagnostic Utility (SDU).

    Kindest regards,
    Tyler

    :9313
  • I'm having exactly the same problem you describe.  All 8 cores go to 100% usage after a minute or two.  Uninstalling KB2393802 fixes the problem.

    :9345
  • Sorry about the delay in replying - been away for a week.

    Just a single machine affected but then again it is the only one using Win7 x64 and SAV.

    Definitely KB2393802 - everything working, install the single update, scans fail.

    I see there is Win7 SP1 now available so hopefully that will resolve the issue but I haven't had the time to try it yet.

    Thanks for taking the time to reply.

    :9739