Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 1 subscriber
  • Views 2795 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos End Point Anti-Virus Protection

MisterSan

Good Morning / Evening everybody.

I'm assuming this may have already been solved but just having no luck finding it.

I look after around 60 networked PC's and a small amount of them (around 6-7) are now getting 'Microsoft Word has stopped working...' error message after they open/close/save any type of documents.

This happens on different OS's and files can either be networked or saved locally to the PC.

The only thing the error logs points to is Sophos, specificall Sopos~1.dll.

The only thing i could find was the 'Scan on rename/saving etc' option, iI've enabled and disabled this and still the problem continues.

Any help would be greatly appreciated.

Thanks,

San.

:34451


This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    As a test to confirm it's detoured dll causing the problem....

    1. Close Word

    2. Open Regedit

    3. Navigate to:

    32-bit computer:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\

    64-bit computer

    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\

    Note: As WINWORD.exe is a 32-bit process on 64-bit, we only need to stop detored loading into 32-bit processes)

    4. Set LoadAppInit_DLLs to 0 (This will prevent any dlls listed in AppInit_DLLs (same key) (of which Sophos is one of them) being loaded into new processes).

    5. Launch Word/Open Save docs as a test.

    6. Repeat this a few times to confirm that stopping dll(s) being loaded into Word in this way helps.

    Once confirmed can you also provide:

    The contents of AppInit_DLLs in the above registry location?  Is there more than one dll listed?

    Using a tool such as ProcessMonitor (http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx), with Word launched, enable the DLL view in the bottom pane and turn on the "Path" column.  Can you copy the text out and make it available so we can se what other modules are loaded into WINWORD.exe.

    The other question is, do you have Data Control enabled?  Does it help to disable that?

    Regards,

    Jak

    :34453
Reply
  • 0

    Hi,

    As a test to confirm it's detoured dll causing the problem....

    1. Close Word

    2. Open Regedit

    3. Navigate to:

    32-bit computer:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\

    64-bit computer

    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\

    Note: As WINWORD.exe is a 32-bit process on 64-bit, we only need to stop detored loading into 32-bit processes)

    4. Set LoadAppInit_DLLs to 0 (This will prevent any dlls listed in AppInit_DLLs (same key) (of which Sophos is one of them) being loaded into new processes).

    5. Launch Word/Open Save docs as a test.

    6. Repeat this a few times to confirm that stopping dll(s) being loaded into Word in this way helps.

    Once confirmed can you also provide:

    The contents of AppInit_DLLs in the above registry location?  Is there more than one dll listed?

    Using a tool such as ProcessMonitor (http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx), with Word launched, enable the DLL view in the bottom pane and turn on the "Path" column.  Can you copy the text out and make it available so we can se what other modules are loaded into WINWORD.exe.

    The other question is, do you have Data Control enabled?  Does it help to disable that?

    Regards,

    Jak

    :34453
Children
No Data