This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos 9's Buffer Overflow Protection System (BOPS) and Internet Explorer 8

Hi,

Just wondering if anyone else has noticed any odd behavior of Internet Explorer since upgrading from Sophos 7 to Sophos 9?

We've found that on a substantial portion of our machines (Windows XP, Windows Server 2003, and possibly even Windows 7) suffer from a reproducible but statistical-in-nature deadlock in Internet Explorer.

I originally reported the problem on Microsoft's Technet forums (http://social.technet.microsoft.com/Forums/en/w7itpronetworking/thread/ef0a7af9-26b9-45b5-a05e-0cfd88c42aee) however it soon became clear that the culprit was Sophos_detoured.dll, part of the BOPS in Sophos 9 (and the timeline of the problem occurred very shortly after upgrading substantial portions of our machines to Sophos 9 from the original Sophos 7 clients they had installed.)

I notice someone else on the MS forums said they had the same problem, so I thought I'd post this here to achieve two things:

1. If other people experience this problem, they may know what's causing it instead of tearing their hair out about it

and

2. Perhaps other people have suggestions or advice

I should point out that we have an open ticket with Sophos about this at the moment [#2345512], and I've discovered at least two workarounds (which are both effectively the same workaround from different directions), so I'm not necessarily after assistance, just healthy discussion and information sharing.

As an aside, after I posted about this issue in a similar way on our internal forums, another IT staff member from a completely unrelated area responded along the lines of "Ahhh! That's what's causing it! We've just been reformatting and re-installing windows since we were stumped by the problems, and we never connected it with the recent upgrade to 9!"

And finally, the easiest workaround to the problem is to disable BOPS and reboot. There's a reghack that achieves effectively the same thing involving the AppInit_DLLs key (see the referenced microsoft forum post for details if you're brave.)

Cheers,

Jon.

:3208


This thread was automatically locked due to age.
Parents
  • Hello all

    Happy to announce three Sophos Detoured issues fixed with the upcoming release of Sophos Anti-Virus 9.5.5, these include IE 8 + detoured conflict, deadlock in detoured and Windows Live Sign-In Assistant + detoured

    Scheduled for release this week, any problems please ensure you are running this release (right mouse click Sophos shield, open Sophos Endpoint Security and Control, help, view product information, expand 'Software' under the Anti-Virus and HIPS section) before contacting Sophos Technical Support.

    If you have currently have open cases with Sophos Technical Support, again please ensure you are running this 9.5.5 release using the above method, or by checking the Anti-Virus tab under Enterprise Console. If you have not heard from the Sophos case owner managing your case, please drop an email to support@sophos.com with your case reference in the format of [#casenumber] , requesting an update.

    We're aware that is a major pain point for our customers and we are working hard to rectify the issues, sadly delays can occur for a variety of reasons such as development being able to replicate the issue, create the fix to resolve the issue, and test the fix to ensure the behaviour does not reoccur.

    Kind Regards

    :8575
Reply
  • Hello all

    Happy to announce three Sophos Detoured issues fixed with the upcoming release of Sophos Anti-Virus 9.5.5, these include IE 8 + detoured conflict, deadlock in detoured and Windows Live Sign-In Assistant + detoured

    Scheduled for release this week, any problems please ensure you are running this release (right mouse click Sophos shield, open Sophos Endpoint Security and Control, help, view product information, expand 'Software' under the Anti-Virus and HIPS section) before contacting Sophos Technical Support.

    If you have currently have open cases with Sophos Technical Support, again please ensure you are running this 9.5.5 release using the above method, or by checking the Anti-Virus tab under Enterprise Console. If you have not heard from the Sophos case owner managing your case, please drop an email to support@sophos.com with your case reference in the format of [#casenumber] , requesting an update.

    We're aware that is a major pain point for our customers and we are working hard to rectify the issues, sadly delays can occur for a variety of reasons such as development being able to replicate the issue, create the fix to resolve the issue, and test the fix to ensure the behaviour does not reoccur.

    Kind Regards

    :8575
Children
No Data