Windows Start Menu Locked Up, unable to restart machine.

We have had this in for weeks now. I am not trying to turn this in to a Sophos bash but the last I heard from support was try the beta with no reasoning as to why.

When I asked "what did development say"? He said "I have not asked development." which of course there is no excuse for. this was after supplying logs and diags from multiple machines followed by a long period of silence. I can certainly see why you can take the stance of giving up especially if you are being flamed by customers. We got our a**** lit up.

 

7849617

Hi Burt, My case I’d with Sophos support is #7862295. i ve been following your comments and excellent work you have done and it seems like I will need to try the same solution with disabling Windows Defender, because I cannot wait for months for a solution from Sophos. We are still new to Sophos, only since last November so I appreciate you have more experience with their support delivering a timely solution than I do. I have involved my reseller today so maybe they can add some pressure to Sophos. Regards Kevin

This is really not a SOPHOS support bashing thing, I really want to dispel this.  I love SOPHOS, I have been around when they took over Astaro, whose Support was just as bad lol

I have given too much time to SOPHOS support, it feels more like a gauntlet than a help center.

I love their products, a bit pricey but really solid stuff.

What funny is, 1 of the machines that I had the issue was hit by ransomware. So, the story goes:

"Burt, my computer is slow and it saying something about bitcoin. "
I promptly panic, jump on and whilst I see the slowness, I witness something i thought i would never see in my life, the exploiters were on the PC too!! They were troubleshooting (controlling the mouse etc) why their ransomware wasn't working!!!!!!!  It was amazing to watch.

I booted them off, InterceptX performed perfectly. SOPHOS AV did not pick up the ransomware, it was totally blind to it. InterceptX nuked the ransomware and then the exploiters were trying to script uninstall it and running password finders etc. Booted into safe mode and cleaned up the PC.

All up, it was a amazing WIN. I don't fault SOPHOS AV for failing, that's life, I now am at the opinion that interceptX is essential, it really is a non negotiable necessity..

Hi Burt,

No problem, I understand and so far in my limited experience with Sophos the support seems good and a lot better than other companies I've worked with. The invested time on problems, like this is frustrating especially when there are many other user issues to mange and of course the threat of Ransomware is very worrying. It sounds like quite an experience you witnessed!

It is good to hear that Intercept X resolved that Ransomware threat you had and it is important we get this issue fully resolved, although I'll try your solution with disabling Windows defender on the systems we know have the problem. So far the majority of existing users seem ok and from what we have experienced it seems any new systems or rebuilds are more likely to see this issue. Not sure why this is..

Regards

Kevin

Hi Burt,

We just had another system show the problem today and tried to disable Windows Defender as documented above, however it still shows the problem after a reboot.. Hopefully we did everything correctly i.e. In Windows Defender -> "App & Brower control" we switched off all the selections as well as in the "Exploit Protection settings" i.e. "Off by default".

In the gpedit.msc we have the Windows Defender Anti-Virus "enabled" which says it is switched off and AV does not run.

One other thing, Sophos was already installed before we disabled Windows Defender would this make a difference?

Did we miss something? Any help would be appreciated.

 

Many thanks

Kevin

Hi,

Very strange, I'll use my unchanged main computer to show you what I did.  My main computer whilst using ALL 3 sophos products (AV, Int Encryp) does not show any signs of the issue.

Just last night I fixed another one, however i noticed that there was some taskhost.exe or something like that trying to install a driver, after doing the steps, i had to reboot a few times.  Like it was stuck installing a driver or something.

I'm not sure if I am doing these and by accident doing something else that is fixing my issue, as I don't understand the problem 100% I can't say for sure if what I am doing is working.  I have gotten all my client's with this issue off my back, so it must be close on the mark?

https://imgur.com/a/B8N8V

Hi Burt,

I tried again today i.e. removing Sophos and making sure Windows Defender was disabled, I reinstalled Sophos but the problem still shows up after a reboot. This is very strange...

Sophos Escalation team just sent me an email of the problem details which seems to not match the issue we are experiencing.. I'll talk to them about this. It is clear to us any new system installation or rebuild will definitely produce the problem every time. Existing users seem to be ok so far.. This is still a big issue for us with new users and or system rebuilds which we have to do. As you said Intercept X is a necessity and running solely with just Endpoint is not what we bought into when moving to Sophos.

Regards

Kevin

Hi All,

It seems Sophos may have a solution or workaround. It appears a new option added in 1709. i.e. switching off the ‘Use my sign–in info to automatically finish setting up my device after an update or restart’  fixes certainly one of my systems so far. It is in "Settings -> Accounts ->Sign options and under Privacy.

http://www.thewindowsclub.com/automatically-launch-previously-open-apps-reboot-windows-10

Let me know if this helps your systems?

Regard's

Kevin

They are all over the place. Yesterday I was told devs said Visual Studio was causing the issue. We have not been able to test that yet.

We did test a new machine fully patched prior to Sophos install. As long as GPO Defender was done prior to Sophos install it was fine.

Kevin how did you test this?

You had a machine that was acting up with Sophos ADV and IX installed, changed this and restarted and then in was fine?