This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos UI.exe steals focus of fullscreen games

If you start a game on an endpoint the game minimizes to taskbar because sophos ui.exe is stealing the focus.
Sometimes after 10 or more times clicking the icon in the taskbar it stays open.

For example with wow from blizzard.(done with a little tool which tracks the focus)

No foreground application | Mon Aug 14 07:20:46 2017
10344:G:\World of Warcraft\Wow-64.exe | Mon Aug 14 07:20:46 2017
11412:C:\Program Files\Sophos\Sophos UI\Sophos UI.exe | Mon Aug 14 07:20:46 2017

We use Central Endpoint Protection Advanced with Intercept X.
Any Ideas?

Greetings

Benny



This thread was automatically locked due to age.
Parents
  • If you open (show) the UI of Sophos, does that help?

    Regards,

    Jak

  • Hi,

    thanks for your reply. I checked now.

    It does not happen when the ui stays open.

    Br

    Benny

  • I don't have a game to try a repro but I'd probably try using a tool such as WinLister:

    http://www.nirsoft.net/utils/winlister.html

    What is the difference (enable "Display Hidden Windows") for the "Sophos UI.exe" process (class = "Sophos.Forms.Control") window when it's visible/hidden.

    Might offer a clue as to why a Sophos UI windows being visible is significant.  I can understand top most being significant but just toggling visible doesn't seem like it should effect other Windows?

    Regards,

    Jak

  • Sophos UI in Tray

    Sophos UI Not in Tray

    The only difference is see is Visible=yes and App Window=yes

  • In that case, the utility WinExplorer might be interesting to use:

    http://www.nirsoft.net/utils/winexp.html

    I know you can change the style of a Window with that tool.

    You should be able to find the parent Sophos.Forms.Control, then under the Style tab and Extended Style tab you can change the Window properties.  E.g. change the WS_POPUP style, this would relate to the "Popup Window" state in the other application, WS_EX_APPWINDOW would be "App Window" etc...

    It would be interesting if you can make the problem go away with the Sophos window still set to Visible = No.

    Maybe check with the other tool that the settings are taking effect.

    Hope it helps narrow it down to a specific Window setting.

    Regards,

    Jak

  • Hi, 

    i tried nearly every combination of check boxes under the styles and extended styles. problem still persists.

    Only if if check the visible checkbox in the general tab the problem went away.

    Regards

    Benny

  • Hi Benny,

    Do you have an example game I could easily get hold of to try and reproduce this? Have you found the issue with games other that WoW you mention?

    Also, what was the utility you used?

    Regards,

    Jak

  • Hi Jak,

    thanks for your quick responses.
    I have not that much games, so i had tested it now with Overwatch also from blizzard and Monkey Island (Steam)
    on the two other games i don't have the issue.
    So perhaps it is only a issue between WoW and Sophos Endpoint.

    I think we can close this until i find other issues.

    Thank you very much for your help!

    Regards Benny

Reply
  • Hi Jak,

    thanks for your quick responses.
    I have not that much games, so i had tested it now with Overwatch also from blizzard and Monkey Island (Steam)
    on the two other games i don't have the issue.
    So perhaps it is only a issue between WoW and Sophos Endpoint.

    I think we can close this until i find other issues.

    Thank you very much for your help!

    Regards Benny

Children
  • Hi Benny,

    Is the resolution configured in WoW different from your desktop resolution?  Sorry, I'm not a game player but I'm sure that is a standard option in games.

    Reason being, I used Window Focus Logger, which is what I think you were using before and if I change the resolution of the display, just using the Windows built in tool, then I see Sophos UI show up.

    I can only assume that the Sophos UI gets the window message: WM_DISPLAYCHANGE - https://msdn.microsoft.com/en-us/library/windows/desktop/dd145210(v=vs.85).aspx - and does some work which causes this.  

    As part of Visual Studio, there is an application called Spy++  You can use this to spy on Windows messages.  If I monitor "Sophos UI.exe" for WM_DISPLAYCHANGE and WM_SETFOCUS, then use a command line tool to set the resolution, e.g.:

    dc.exe -width=1280 -height=768
    dc.exe -width=1366 -height=768

    Then I see the following messages:

    <000001> 0000000000060966 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000002> 0000000000060966 R WM_DISPLAYCHANGE lResult:0000000000000000
    <000003> 0000000000050960 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000004> 0000000000050960 R WM_DISPLAYCHANGE lResult:0000000000000000
    <000005> 0000000000050954 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000006> 0000000000050954 R WM_DISPLAYCHANGE lResult:0000000000000000
    <000007> 000000000008083E S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000008> 000000000008083E R WM_DISPLAYCHANGE lResult:0000000000000000
    <000009> 00000000000E0780 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000010> 00000000000E0780 R WM_DISPLAYCHANGE lResult:0000000000000000
    <000011> 00000000000707EC S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000012> 00000000000707EC R WM_DISPLAYCHANGE lResult:0000000000000000
    <000013> 000000000005096C S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000014> 000000000005096C S WM_SETFOCUS hwndLoseFocus:(null) [wParam:0000000000000000 lParam:0000000000000000]
    <000015> 000000000005096C R WM_SETFOCUS lResult:0000000000000000
    <000016> 000000000005096C R WM_DISPLAYCHANGE lResult:0000000000000000
    <000017> 0000000000050964 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000018> 0000000000050964 R WM_DISPLAYCHANGE lResult:0000000000000000
    <000019> 0000000000050956 S WM_DISPLAYCHANGE cBitsPerPixel:32 cxScreen:1366 cyScreen:768 [wParam:0000000000000020 lParam:0000000003000556]
    <000020> 0000000000050956 R WM_DISPLAYCHANGE lResult:0000000000000000

    So I suspect this WM_SETFOCUS is the reason.  If I spy on another application such as Process Explorer, for the same messages, then I just see the WM_DISPLAYCHANGE not the WM_SETFOCUS.

    I imagine games are the main apps that might cause this where focus is important.  I wonder if the resolution isn't changing then maybe you don't see the issue?

    Regards,

    Jak

  • Hi Jak,

    i checked the settings.
    On Desktop i have 1920x1080 and in WoW i have the same settings.
    I tried to change the frequency from 50 to 60 Hz within the game, but no change.
    Same behavior as before. 

    Regards

    Benny