Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 25 replies
  • Subscribers 1 subscriber
  • Views 30682 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Crash - Chrome

minimoo
Hello,
Just wondering if anyone else is aware of the sophos web intelligence module seemingly crashing within google chrome:
 
Faulting application name: chrome.exe, version: 0.0.0.0, time stamp: 0x4d490687
Faulting module name: swi_filter_0001.dll, version: 1.0.5.0, time stamp: 0x4ca1f9cb
Exception code: 0xc0000005
Fault offset: 0x00014915
Faulting process id: 0x1920
Faulting application start time: 0x01cbc55d3a55a1c0
Faulting application path: C:\Users\Paul\AppData\Local\Google\Chrome\Application\chrome.exe
Faulting module path: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_filter_0001.dll
Report Id: 5d749190-3153-11e0-9750-001a92782b5b

Faulting application name: chrome.exe, version: 0.0.0.0, time stamp: 0x4d490687

Faulting module name: swi_filter_0001.dll, version: 1.0.5.0, time stamp: 0x4ca1f9cbException code: 0xc0000005

Fault offset: 0x00014915

Faulting process id: 0x1920

Faulting application start time: 0x01cbc55d3a55a1c0

Faulting application path: C:\Users\Paul\AppData\Local\Google\Chrome\Application\chrome.exe

Faulting module path: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_filter_0001.dll

Report Id: 5d749190-3153-11e0-9750-001a92782b5b

FAULTING_IP: 

swi_filter_0001!HTTPFilterBlockPageBytesProcessed+124e5

70084915 8a1a            mov     bl,byte ptr [edx]

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)

ExceptionAddress: 70084915 (swi_filter_0001!HTTPFilterBlockPageBytesProcessed+0x000124e5)

   ExceptionCode: c0000005 (Access violation)

  ExceptionFlags: 00000000

NumberParameters: 2

   Parameter[0]: 00000000

   Parameter[1]: 068f5000

Attempt to read from address 068f5000

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
044ff5fc 700846fe 0632cff8 068f5000 ffffffff swi_filter_0001!HTTPFilterBlockPageBytesProcessed+0x124e5
044ff618 7008484d ffffffff 0632ced0 7007fa73 swi_filter_0001!HTTPFilterBlockPageBytesProcessed+0x122ce
044ff624 7007fa73 0632ce60 044ff710 0632c580 swi_filter_0001!HTTPFilterBlockPageBytesProcessed+0x1241d
044ff634 70077ac4 068f3224 ffffffff 870d0489 swi_filter_0001!HTTPFilterBlockPageBytesProcessed+0xd643
044ff688 778f8a18 02d80000 00d80ca0 00000000 swi_filter_0001!HTTPFilterBlockPageBytesProcessed+0x5694
044ff6c8 02d80ad0 044ff7c0 778f2e5e 02d80138 ntdll!RtlpDeCommitFreeBlock+0x9a
044ff710 70071f0c 068f3000 870d0519 00000000 0x2d80ad0
044ff7d8 72611fc2 0632c580 068f3000 00000223 swi_filter_0001!HTTPFilterRecvFromServer+0x4c
00000000 00000000 00000000 00000000 00000000 swi_lsp+0x1fc2
:8837


This thread was automatically locked due to age.
  • 0

    Hi,

    Can't say I have and I use Chrome and the "Web protection" filter.  Can I ask what versions are involved?

    OS: Windows 7 Pro 64 bit?

    SAV: SAV Version 9.5.5?  All rebooted recently to ensure the latest LSP is loaded?

    What verison of Chrome? 9.0.597.84?

    The output of:
    netsh winsock show catalog > winsock.txt
    Is always useful.

    Also when does it crash, at startup or just when using it after x number of minutes?

    Certain web page, etc..?

    IE and Firefox all ok?

    Regards,

    Jak

    :8839
  • 0

    Hi Jak,

    Chrome's actually running a *beta* version at the moment ( 9.0.597.86 beta ), SAV is 9.5.5.

    IE/Firefox - not noticed a crash yet. 

    It was after X minutes (maybe on a certain webpage - i'll need to check)

    winsock catalog looks reasonable atm - I think I'll wait a bit before posting it.

    OS: 7 , 64bit.

    When it next occurs, i'll try and do some better diagnostics :)

    Paul

    :8841
  • 0

    Hi,

    I'm also running Win 7 64 bit (Pro).  SAV 9.5.5 and have just updated to the Beta release of Chrome (9.0.597.86 beta). No problems as yet, so if there is a bug in there it must be excited by a specific scenario.

    Looking in the parent Chrome.exe process with Process Explorer (http://technet.microsoft.com/en-us/sysinternals/bb896653) I have the following two web scanning dlls loaded:

    "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_filter_0001.dll" (1.0.5.0)
    "C:\ProgramData\Sophos Web Intelligence\swi_lsp.dll" (1.0.6.0)
    and the detoured version of:
    "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured.dll" (9.5.0.9530)
    Can you confirm the same?
    I'll post back if I see something similar.
    Jak
    :8843
  • 0

    I have sophos_detoured.dll version 9.5.5.9574

    At same time, not seen a crash since this post (yet)

    Paul

    :8845
  • 0

    Incidently, still getting this, and it seems to be random - got it just now when going to http://flexigrid.info/sample1.html

    However, reloading that page in a new window was fine afterwards ;/

    :9053
  • 0

    A lot of people are having this problem.

    I've had it with Atlassin Jira with every version of Chrome, including the Stable, Beta, and Dev channels.

    http://code.google.com/p/chromium/issues/detail?id=67897

    :10843
  • 0

    I can confirm the same as the last post - we're having significant problems on Windows XP (Pro)  with Chrome (and occasionally Firefox) crashing, primarily against our internal Atlassian installations: Confluence, JIRA, FishEye.

    The crashes affect a variety of the Chrome versions, up to and including the current 10.0.648.204 - I can not confirm any beta use.  Chrome crashes very reliably against our installs to the point that it is useless - usually on the first or second page access.  Occasionally a session will work for some period of time, though it appears to be the exception, not the rule.

    Firefox versions up to the current 3.6.16 have the same issue, though much less frequently and are not repeatable.

    Installs without Sophos seem to have no issues accessing these sites with either browser.  Additionally, we've used Chrome and Firefox for a couple of years with these tools with no issues - until we upgraded to Sophos early this year.

    :11345
  • 0

    Has anyone opened a case with Sophos on this issue?

    :12241
  • 0

    For those having the problem frequently, if you disable the "web protection" component is it then ok?

    On the client this can be found under  "Configure" -> "Anti-virus" - > "Web protection".  It will then need a reboot.

    Thanks,

    Jak

    :12247
  • 0

    I don't think they have a fix for this yet. I have a case open with them, and they have been getting SDU logs from clients, and the Console server. I noticed that if we turn OFF our iPrism content filter appliance on our network, this issue seems to go away. (I haven't tested for long, but inital tests show this to be true.

    EVen though we have the website scanning/downloading turned off on Sophos, it still seems to crash browsers if the content filter is on.

    :20229