Sophos Web Intelligence crashes Firefox intermittently when printing web pages

Hi,

The modules tab just highlights the modules loaded into the process at the time of the hang/crash without symbols. Of course Sophos modules would be listed as Sophos doesn't make it's symbols available publicly.  

The crashing stack doesn't have a sophos module on it.

How intermittent is it?  For example, how long would it be before a change could be verified as having fixed the issue?

You mention that you uninstalled/reinstalled Sophos: Did it still happen when Sophos was removed?  Is this why you believe the issue is due to Sophos?

Without a total uninstall: One approach would be to disable the loaded Sophos modules in the process and see if still occurs.  You say that "disabling Web services is not an option" is there a reason just for testing?

To remove the LSP (swi_ifslsp.dll) and filter (swi_filter.dll) DLLs being loaded into Firefox, you can disable web protection and web control and reboot.  To prove the LSP DLL (which pulls in the filter dll for browser processes) is unloaded post reboot, you can run in an admin prompt:

Netsh winsock show catalog > cat.txt

When Sophos is loaded you will see references to the Sophos LSP dll, when it's not, then the Sophos DLL is not references in the catalog.

The other module to perhaps rule out is sophos_detoured.dll. You can see it reference in the metadata tab:

%ProgramFiles%\Sophos\Sophos Anti-Virus\sophos_detoured.dll

You could disable that from loading in Firefox processes by going to both (to cover the 32-bit and 64-bit processes of Firefox):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows NT\CurrentVersion\Windows
and removing the Sophos path/dll from the AppInit_DLLs key.

It would be worth exporting the keys or backing up the strings in each location so the path can be restored.

Now when you restart the firefox.exe process, the sophos_detoured.dll will no longer be loaded.

Hopefully these test will reveal if the issue is due to a Sophos module and which one.

Regards,
Jak

Hi,

The modules tab just highlights the modules loaded into the process at the time of the hang/crash without symbols. Of course Sophos modules would be listed as Sophos doesn't make it's symbols available publicly.  

The crashing stack doesn't have a sophos module on it.

How intermittent is it?  For example, how long would it be before a change could be verified as having fixed the issue?

You mention that you uninstalled/reinstalled Sophos: Did it still happen when Sophos was removed?  Is this why you believe the issue is due to Sophos?

Without a total uninstall: One approach would be to disable the loaded Sophos modules in the process and see if still occurs.  You say that "disabling Web services is not an option" is there a reason just for testing?

To remove the LSP (swi_ifslsp.dll) and filter (swi_filter.dll) DLLs being loaded into Firefox, you can disable web protection and web control and reboot.  To prove the LSP DLL (which pulls in the filter dll for browser processes) is unloaded post reboot, you can run in an admin prompt:

Netsh winsock show catalog > cat.txt

When Sophos is loaded you will see references to the Sophos LSP dll, when it's not, then the Sophos DLL is not references in the catalog.

The other module to perhaps rule out is sophos_detoured.dll. You can see it reference in the metadata tab:

%ProgramFiles%\Sophos\Sophos Anti-Virus\sophos_detoured.dll

You could disable that from loading in Firefox processes by going to both (to cover the 32-bit and 64-bit processes of Firefox):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows NT\CurrentVersion\Windows
and removing the Sophos path/dll from the AppInit_DLLs key.

It would be worth exporting the keys or backing up the strings in each location so the path can be restored.

Now when you restart the firefox.exe process, the sophos_detoured.dll will no longer be loaded.

Hopefully these test will reveal if the issue is due to a Sophos module and which one.

Regards,
Jak