This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos UI.exe steals focus of fullscreen games

If you start a game on an endpoint the game minimizes to taskbar because sophos ui.exe is stealing the focus.
Sometimes after 10 or more times clicking the icon in the taskbar it stays open.

For example with wow from blizzard.(done with a little tool which tracks the focus)

No foreground application | Mon Aug 14 07:20:46 2017
10344:G:\World of Warcraft\Wow-64.exe | Mon Aug 14 07:20:46 2017
11412:C:\Program Files\Sophos\Sophos UI\Sophos UI.exe | Mon Aug 14 07:20:46 2017

We use Central Endpoint Protection Advanced with Intercept X.
Any Ideas?

Greetings

Benny

This thread was automatically locked due to age.

Parents

0 jak over 7 years ago

If you open (show) the UI of Sophos, does that help?

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 benny4982 over 7 years ago in reply to jak

Hi,

thanks for your reply. I checked now.

It does not happen when the ui stays open.

Br

Benny
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 7 years ago in reply to benny4982

I don't have a game to try a repro but I'd probably try using a tool such as WinLister:

http://www.nirsoft.net/utils/winlister.html

What is the difference (enable "Display Hidden Windows") for the "Sophos UI.exe" process (class = "Sophos.Forms.Control") window when it's visible/hidden.

Might offer a clue as to why a Sophos UI windows being visible is significant. I can understand top most being significant but just toggling visible doesn't seem like it should effect other Windows?

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 benny4982 over 7 years ago in reply to jak

Sophos UI in Tray

Sophos UI Not in Tray

The only difference is see is Visible=yes and App Window=yes
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 7 years ago in reply to benny4982

In that case, the utility WinExplorer might be interesting to use:

http://www.nirsoft.net/utils/winexp.html

I know you can change the style of a Window with that tool.

You should be able to find the parent Sophos.Forms.Control, then under the Style tab and Extended Style tab you can change the Window properties. E.g. change the WS_POPUP style, this would relate to the "Popup Window" state in the other application, WS_EX_APPWINDOW would be "App Window" etc...

It would be interesting if you can make the problem go away with the Sophos window still set to Visible = No.

Maybe check with the other tool that the settings are taking effect.

Hope it helps narrow it down to a specific Window setting.

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 benny4982 over 7 years ago in reply to jak

Hi,

i tried nearly every combination of check boxes under the styles and extended styles. problem still persists.

Only if if check the visible checkbox in the general tab the problem went away.

Regards

Benny
Cancel
Vote Up 0 Vote Down

Cancel
+1 jak over 7 years ago in reply to benny4982

Hi Benny,

Do you have an example game I could easily get hold of to try and reproduce this? Have you found the issue with games other that WoW you mention?

Also, what was the utility you used?

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel

Reply

+1 jak over 7 years ago in reply to benny4982

Hi Benny,

Do you have an example game I could easily get hold of to try and reproduce this? Have you found the issue with games other that WoW you mention?

Also, what was the utility you used?

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 benny4982 over 7 years ago in reply to jak

Hi Jak,

thanks for your quick responses.
I have not that much games, so i had tested it now with Overwatch also from blizzard and Monkey Island (Steam)
on the two other games i don't have the issue.
So perhaps it is only a issue between WoW and Sophos Endpoint.

I think we can close this until i find other issues.

Thank you very much for your help!

Regards Benny
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 7 years ago in reply to benny4982

Hi Benny,

Is the resolution configured in WoW different from your desktop resolution? Sorry, I'm not a game player but I'm sure that is a standard option in games.

Reason being, I used Window Focus Logger, which is what I think you were using before and if I change the resolution of the display, just using the Windows built in tool, then I see Sophos UI show up.

I can only assume that the Sophos UI gets the window message: WM_DISPLAYCHANGE - https://msdn.microsoft.com/en-us/library/windows/desktop/dd145210(v=vs.85).aspx - and does some work which causes this.

As part of Visual Studio, there is an application called Spy++ You can use this to spy on Windows messages. If I monitor "Sophos UI.exe" for WM_DISPLAYCHANGE and WM_SETFOCUS, then use a command line tool to set the resolution, e.g.:

dc.exe -width=1280 -height=768
dc.exe -width=1366 -height=768

Then I see the following messages:

<000001> 0000000000060966 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
<000002> 0000000000060966 R WM_DISPLAYCHANGE lResult:0000000000000000
<000003> 0000000000050960 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
<000004> 0000000000050960 R WM_DISPLAYCHANGE lResult:0000000000000000
<000005> 0000000000050954 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
<000006> 0000000000050954 R WM_DISPLAYCHANGE lResult:0000000000000000
<000007> 000000000008083E S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
<000008> 000000000008083E R WM_DISPLAYCHANGE lResult:0000000000000000
<000009> 00000000000E0780 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
<000010> 00000000000E0780 R WM_DISPLAYCHANGE lResult:0000000000000000
<000011> 00000000000707EC S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
<000012> 00000000000707EC R WM_DISPLAYCHANGE lResult:0000000000000000
<000013> 000000000005096C S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
<000014> 000000000005096C S WM_SETFOCUS hwndLoseFocus:(null) [wParam:0000000000000000 lParam:0000000000000000]
<000015> 000000000005096C R WM_SETFOCUS lResult:0000000000000000
<000016> 000000000005096C R WM_DISPLAYCHANGE lResult:0000000000000000
<000017> 0000000000050964 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
<000018> 0000000000050964 R WM_DISPLAYCHANGE lResult:0000000000000000
<000019> 0000000000050956 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
<000020> 0000000000050956 R WM_DISPLAYCHANGE lResult:0000000000000000

So I suspect this WM_SETFOCUS is the reason. If I spy on another application such as Process Explorer, for the same messages, then I just see the WM_DISPLAYCHANGE not the WM_SETFOCUS.

I imagine games are the main apps that might cause this where focus is important. I wonder if the resolution isn't changing then maybe you don't see the issue?

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 benny4982 over 7 years ago in reply to jak

Hi Jak,

i checked the settings.
On Desktop i have 1920x1080 and in WoW i have the same settings.
I tried to change the frequency from 50 to 60 Hz within the game, but no change.
Same behavior as before.

Regards

Benny
Cancel
Vote Up 0 Vote Down

Cancel