Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 3 subscribers
  • Views 2505 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Web Intelligence crashes Firefox intermittently when printing web pages

Robert Frumin

Below is a link to the crash report. You can see the faulting modules on the modules tab.

This is not an issue in other browsers. I've tried uninstalling/reinstalling firefox, recreating FF profile, and uninstalling/reinstalling Sophos. 

Disabling Web services is not an option. There are no issues communicating with the client in the enterprise console

 

 

crash-stats.mozilla.com/.../9977e0f7-997f-42f8-b0ef-a180e2170316



This thread was automatically locked due to age.
  • 0

    Hi,

    The modules tab just highlights the modules loaded into the process at the time of the hang/crash without symbols. Of course Sophos modules would be listed as Sophos doesn't make it's symbols available publicly.  

    The crashing stack doesn't have a sophos module on it.

    How intermittent is it?  For example, how long would it be before a change could be verified as having fixed the issue?

    You mention that you uninstalled/reinstalled Sophos: Did it still happen when Sophos was removed?  Is this why you believe the issue is due to Sophos?

    Without a total uninstall: One approach would be to disable the loaded Sophos modules in the process and see if still occurs.  You say that "disabling Web services is not an option" is there a reason just for testing?

    To remove the LSP (swi_ifslsp.dll) and filter (swi_filter.dll) DLLs being loaded into Firefox, you can disable web protection and web control and reboot.  To prove the LSP DLL (which pulls in the filter dll for browser processes) is unloaded post reboot, you can run in an admin prompt:

    Netsh winsock show catalog > cat.txt

    When Sophos is loaded you will see references to the Sophos LSP dll, when it's not, then the Sophos DLL is not references in the catalog.

    The other module to perhaps rule out is sophos_detoured.dll. You can see it reference in the metadata tab:

    AppInitDLLs 
    %ProgramFiles%\Sophos\Sophos Anti-Virus\sophos_detoured.dll

    You could disable that from loading in Firefox processes by going to both (to cover the 32-bit and 64-bit processes of Firefox):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows NT\CurrentVersion\Windows
    and removing the Sophos path/dll from the AppInit_DLLs key.

    It would be worth exporting the keys or backing up the strings in each location so the path can be restored.

    Now when you restart the firefox.exe process, the sophos_detoured.dll will no longer be loaded.

    Hopefully these test will reveal if the issue is due to a Sophos module and which one.

    Regards,
    Jak



Unfiltered HTML