This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Endpoint & InterceptX - causing Internet Explorer to crash

Hello,

My company have recently pushed out Sophos Endpoint version 11.5.4 along with InterceptX to a large number of Windows 7 (64bit) computers. The deployment largely went well, but since the installation, we've had a surge of users reporting issues with Internet Explorer crashing or behaving erratically...

Having checked the event logs from a couple of computers these symptoms have been reported on - there appears to be similar errors as below:

"The program IEXPLORE.EXE version 11.0.9600.18618 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 1c98
Start Time: 01d2c4b4f9457e62
Termination Time: 16
Application Path: C:\Program Files\Internet Explorer\IEXPLORE.EXE
Report Id: 6978f697-30b7-11e7-89cd-ac162d110386"

Having uninstalled Sophos from two of these machines and asked the users to monitor IE behaviour for a couple of days - they no longer had these issues. Has anyone else had similar problems and if so, what did you do to fix?

Thank you for any assistance anyone can provide.

This thread was automatically locked due to age.

Parents

Mike Therrien over 6 years ago

Yes I am having the same issue. I am not getting an logs but IE is opening with a white screen and then closing. With in the task manager it show IE not responding. I tried to open a case but could not reproduce the problem when the tech was connected. I think it might have something to do with the windsock. When there is an active connection to the internet it doesn't happen. I took a video with my cell phone and sent it to sophos to create a case.
Cancel
Vote Up 0 Vote Down

Cancel
jak over 6 years ago in reply to Mike Therrien

I would suggest following the guidance in this post:
https://community.sophos.com/products/endpoint-security-control/f/sophos-endpoint-software/86219/software-hangs-with-endpoint-installed

I.e. prevent IE from loading Sophos detours. If that helps, having disabled it on a couple of computers for a few days, getting a full dump of the IE process in the hung state would be the next step.

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
Simon Waddingham over 6 years ago in reply to jak

Hello jak, I shall attempt this on a few users workstations that have reported these problems and report back. Thanks for your response.
Cancel
Vote Up 0 Vote Down

Cancel
Simon Waddingham over 6 years ago in reply to Simon Waddingham

Performing the following registry changes seems to help with the issue:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\
LoadAppInit_DLLs = 0

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows
LoadAppInit_DLLs = 0

I've tested this with around 5 users and immediately all noticed a difference. I have a case open with Sophos Tech Support so will run the iexplore dump and forward it onto them as per Jak's post here:

https://community.sophos.com/products/endpoint-security-control/f/sophos-endpoint-software/86219/software-hangs-with-endpoint-installed

Thanks for this Jak.
Cancel
Vote Up 0 Vote Down

Cancel
jak over 6 years ago in reply to Simon Waddingham

No problem, glad it's narrowed it down a little.

To disable detours being re-registered in the future on an update there are these keys that can be created"

64-bit computers:
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\SetupOptions]
"DetourDLLState"="excluded"

32-bit computers:
[HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\SAVService\SetupOptions]
"DetourDLLState"="excluded"

With this in place, the SAV installer will not attempt to re-register the Appinit dll.

Note: they are strings.

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel

Reply

jak over 6 years ago in reply to Simon Waddingham

No problem, glad it's narrowed it down a little.

To disable detours being re-registered in the future on an update there are these keys that can be created"

64-bit computers:
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\SAVService\SetupOptions]
"DetourDLLState"="excluded"

32-bit computers:
[HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\SAVService\SetupOptions]
"DetourDLLState"="excluded"

With this in place, the SAV installer will not attempt to re-register the Appinit dll.

Note: they are strings.

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data