This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos UI.exe steals focus of fullscreen games

If you start a game on an endpoint the game minimizes to taskbar because sophos ui.exe is stealing the focus.
Sometimes after 10 or more times clicking the icon in the taskbar it stays open.

For example with wow from blizzard.(done with a little tool which tracks the focus)

No foreground application | Mon Aug 14 07:20:46 2017
10344:G:\World of Warcraft\Wow-64.exe | Mon Aug 14 07:20:46 2017
11412:C:\Program Files\Sophos\Sophos UI\Sophos UI.exe | Mon Aug 14 07:20:46 2017

We use Central Endpoint Protection Advanced with Intercept X.
Any Ideas?

Greetings

Benny



This thread was automatically locked due to age.
Parents Reply Children
  • Hi Benny,

    Do you have an example game I could easily get hold of to try and reproduce this? Have you found the issue with games other that WoW you mention?

    Also, what was the utility you used?

    Regards,

    Jak

  • Hi Jak,

    thanks for your quick responses.
    I have not that much games, so i had tested it now with Overwatch also from blizzard and Monkey Island (Steam)
    on the two other games i don't have the issue.
    So perhaps it is only a issue between WoW and Sophos Endpoint.

    I think we can close this until i find other issues.

    Thank you very much for your help!

    Regards Benny

  • Hi Benny,

    Is the resolution configured in WoW different from your desktop resolution?  Sorry, I'm not a game player but I'm sure that is a standard option in games.

    Reason being, I used Window Focus Logger, which is what I think you were using before and if I change the resolution of the display, just using the Windows built in tool, then I see Sophos UI show up.

    I can only assume that the Sophos UI gets the window message: WM_DISPLAYCHANGE - https://msdn.microsoft.com/en-us/library/windows/desktop/dd145210(v=vs.85).aspx - and does some work which causes this.  

    As part of Visual Studio, there is an application called Spy++  You can use this to spy on Windows messages.  If I monitor "Sophos UI.exe" for WM_DISPLAYCHANGE and WM_SETFOCUS, then use a command line tool to set the resolution, e.g.:

    dc.exe -width=1280 -height=768
    dc.exe -width=1366 -height=768

    Then I see the following messages:

    <000001> 0000000000060966 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000002> 0000000000060966 R WM_DISPLAYCHANGE lResult:0000000000000000
    <000003> 0000000000050960 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000004> 0000000000050960 R WM_DISPLAYCHANGE lResult:0000000000000000
    <000005> 0000000000050954 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000006> 0000000000050954 R WM_DISPLAYCHANGE lResult:0000000000000000
    <000007> 000000000008083E S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000008> 000000000008083E R WM_DISPLAYCHANGE lResult:0000000000000000
    <000009> 00000000000E0780 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000010> 00000000000E0780 R WM_DISPLAYCHANGE lResult:0000000000000000
    <000011> 00000000000707EC S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000012> 00000000000707EC R WM_DISPLAYCHANGE lResult:0000000000000000
    <000013> 000000000005096C S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000014> 000000000005096C S WM_SETFOCUS hwndLoseFocus:(null) [wParam:0000000000000000 lParam:0000000000000000]
    <000015> 000000000005096C R WM_SETFOCUS lResult:0000000000000000
    <000016> 000000000005096C R WM_DISPLAYCHANGE lResult:0000000000000000
    <000017> 0000000000050964 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000018> 0000000000050964 R WM_DISPLAYCHANGE lResult:0000000000000000
    <000019> 0000000000050956 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000020> 0000000000050956 R WM_DISPLAYCHANGE lResult:0000000000000000

    So I suspect this WM_SETFOCUS is the reason.  If I spy on another application such as Process Explorer, for the same messages, then I just see the WM_DISPLAYCHANGE not the WM_SETFOCUS.

    I imagine games are the main apps that might cause this where focus is important.  I wonder if the resolution isn't changing then maybe you don't see the issue?

    Regards,

    Jak

  • Hi Jak,

    i checked the settings.
    On Desktop i have 1920x1080 and in WoW i have the same settings.
    I tried to change the frequency from 50 to 60 Hz within the game, but no change.
    Same behavior as before. 

    Regards

    Benny