kennysarmy Posted November 6, 2017 Posted November 6, 2017 Also posted in the security forum: Case opened with Sophos about this: Details are: We have a piece of software from Capita called SIMS.net which is our schools information management software that is required on all our teacher PC's. We've been testing a new (and first) roll out of some Windows 10 PC's and have been trying to work out why the installation of SIMS.net was failing, we've narrowed it down to the co-existence of Intercept X on the computer. If we install with no Endpoint Advanced or just with Endpoint Advanced it's fine, as soon as we add Intercept X we cannot get the SIMS.net programme to install correctly. The failed PC gives this information from the console used to "push" out the software (called SOLUS 3) "2017-11-06 08:40:56 Decompiling of the package SIMS Summer 2017 Full Release (7.176.43)(SIMS Workstation) failed" We've not had this issue with Windows 7 64 Bit. Has anyone seen anything similar? 1
Michael Posted November 6, 2017 Posted November 6, 2017 To be fair, I think Sophos are right to categorise SIMS as malware Joke aside, can you not add the relevant executables to an exceptions list? Or possibly anything coming from your mapped SIMS share?
kennysarmy Posted November 6, 2017 Author Posted November 6, 2017 To be fair, I think Sophos are right to categorise SIMS as malware Joke aside, can you not add the relevant executables to an exceptions list? Or possibly anything coming from your mapped SIMS share? We did try adding some folder entries in to the SOPHOS Global Exclusions - but I am not sure if this is just read by the Sophos Endpoint Protection, not the Intercept X product. Intrigued to what Sophos will say when they respond to my open call.
thatley Posted November 6, 2017 Posted November 6, 2017 (edited) Hi Kenny / Michael, We have a call logged with Atomwide (which has gone to Sophos about this issue). As you say, it is definitely Intercept X. No matter how you deploy SIMS.Net, it stops the installation files from running, which is a huge ball ache for us as we deploy through a script and have 68 schools do deal with! Sophos have asked me to run the diagnostic tool (which we're doing now) so I'll see what comes of it. I've tried excluding all setup files/folders related to Sims.Net, disabled Sophos etc etc but has no effect. We're getting this on Windows 7 x64 and x86. The only workaround so far is to do this on a workstation: "Disable the hmpalert.sys driver (Intercept X)" 1. regedit and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hmpalert 2. Change Start from 3 (enabled) to 4 (disabled) and reboot 3. Run Simsinst.exe until finished (or run whatever routine to install SIMS). Test Sims.Net 4. Change above registry key back, Start from 4 (disabled) to 3 (enabled) and reboot to re-enable Intercept X. Hope this helps for now. I'll report back if I get any answers and look out if any of you get anywhere also. Edited November 6, 2017 by thatley 1
kennysarmy Posted November 7, 2017 Author Posted November 7, 2017 Hi Kenny / Michael, We have a call logged with Atomwide (which has gone to Sophos about this issue). As you say, it is definitely Intercept X. No matter how you deploy SIMS.Net, it stops the installation files from running, which is a huge ball ache for us as we deploy through a script and have 68 schools do deal with! Sophos have asked me to run the diagnostic tool (which we're doing now) so I'll see what comes of it. I've tried excluding all setup files/folders related to Sims.Net, disabled Sophos etc etc but has no effect. We're getting this on Windows 7 x64 and x86. The only workaround so far is to do this on a workstation: "Disable the hmpalert.sys driver (Intercept X)" 1. regedit and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hmpalert 2. Change Start from 3 (enabled) to 4 (disabled) and reboot 3. Run Simsinst.exe until finished (or run whatever routine to install SIMS). Test Sims.Net 4. Change above registry key back, Start from 4 (disabled) to 3 (enabled) and reboot to re-enable Intercept X. Hope this helps for now. I'll report back if I get any answers and look out if any of you get anywhere also. How does the workaround cope if there is an update to be pushed via SOLUS 3? We can get SIMS.net installed by installing it before we install Sophos Endpoint Protection/Intercept X - but I can't deploy PC's to the masses not knowing what will happen if there is an update - I need assurances and a fix from Sophos!
thatley Posted November 7, 2017 Posted November 7, 2017 How does the workaround cope if there is an update to be pushed via SOLUS 3? We can get SIMS.net installed by installing it before we install Sophos Endpoint Protection/Intercept X - but I can't deploy PC's to the masses not knowing what will happen if there is an update - I need assurances and a fix from Sophos! This is more of a workaround to fix any ad-hoc / new machines / one's to rebuild, that don't have SIMS.Net. This doesn't really help us either as we have so many machines to deal with around the borough. The reg change just disables the Hitman service which houses Intercept X so will allow SIMS.net to install in whatever way you do it, however, I'm not happy about our machines being vulnerable in that state, as I'm sure you won't be. Lets hope SOPHOS come up with a solution - FAST!!! I sent off our SDU logs yesterday so hoping that will help Sophos.
kennysarmy Posted November 7, 2017 Author Posted November 7, 2017 This is more of a workaround to fix any ad-hoc / new machines / one's to rebuild, that don't have SIMS.Net. This doesn't really help us either as we have so many machines to deal with around the borough. The reg change just disables the Hitman service which houses Intercept X so will allow SIMS.net to install in whatever way you do it, however, I'm not happy about our machines being vulnerable in that state, as I'm sure you won't be. Lets hope SOPHOS come up with a solution - FAST!!! I sent off our SDU logs yesterday so hoping that will help Sophos. Our SDU logs went off yesterday and we've heard nothing back so I sent them again today ! - - - Updated - - - Surprised there are not more schools with Intercept X on Windows 10 having the same issues rolling out SIMS.net via SOLUS 3 - does this mean some schools are not having this issue?
thatley Posted November 7, 2017 Posted November 7, 2017 Yes that is worrying. I was glad we came across your post on here and on the Sophos Forum, but there's been little else said. Thought it would be widespread. This also happens if you run SIMSINST.exe manually (at the prerequisites stage).
kennysarmy Posted November 7, 2017 Author Posted November 7, 2017 Yes that is worrying. I was glad we came across your post on here and on the Sophos Forum, but there's been little else said. Thought it would be widespread. This also happens if you run SIMSINST.exe manually (at the prerequisites stage). Be good if a few schools could confirm they are also running Windows 10 (which version?), SOLUS 3 and Sophos Endpoint Protection (or not) with Intercept X and are successfully installing SIMS! @PhilNeal - have you heard of any issues?
thatley Posted November 7, 2017 Posted November 7, 2017 Be good if a few schools could confirm they are also running Windows 10 (which version?), SOLUS 3 and Sophos Endpoint Protection (or not) with Intercept X and are successfully installing SIMS! @PhilNeal - have you heard of any issues? Happens on Win 7 64 and 32 for us, so don't think it's version specific (as far as I've seen). My colleague is going to SLUG meeting next week and she's going to raise it with the members to see if anyone else experiencing the issue.
newpersn Posted November 7, 2017 Posted November 7, 2017 Be good if a few schools could confirm they are also running Windows 10 (which version?), SOLUS 3 and Sophos Endpoint Protection (or not) with Intercept X and are successfully installing SIMS! @PhilNeal - have you heard of any issues? No problems here with sophos or Intercept X Windows 10 Edu 1703 and 1709. The only problem i had was with Robocopy but ive allowed it. 1
kennysarmy Posted November 7, 2017 Author Posted November 7, 2017 No problems here with sophos or Intercept X Windows 10 Edu 1703 and 1709. The only problem i had was with Robocopy but ive allowed it. We're on LTSB 2016, but I do have a 1703 education version which we're going to try rolling out SIMS.net via SOLUS 3 this morning.
deano3693 Posted November 7, 2017 Posted November 7, 2017 We are also having this issue and have a call logged with Sophos. As yet we haven't received anything back from Sophos but Capita have confirmed it is Intercept X causing the problem. Dean. 1
kennysarmy Posted November 7, 2017 Author Posted November 7, 2017 We are also having this issue and have a call logged with Sophos. As yet we haven't received anything back from Sophos but Capita have confirmed it is Intercept X causing the problem. Dean. Can I ask what version of Windows 10?
deano3693 Posted November 7, 2017 Posted November 7, 2017 Can I ask what version of Windows 10? We're 1607 across the site here!
kennysarmy Posted November 7, 2017 Author Posted November 7, 2017 We're 1607 across the site here! Windows 10 deployed across the site even with this issue? Has it just started occurring?
deano3693 Posted November 7, 2017 Posted November 7, 2017 Windows 10 deployed across the site even with this issue? Has it just started occurring? Yes only started occurring in the last couple of weeks so something has changed with Solus/Sophos Intercept X to cause this issue. It only affects newly rebuilt machines. We haven't had any updates so can't say it is causes issues with updates either.
CadlaM Posted November 7, 2017 Posted November 7, 2017 Be good if a few schools could confirm they are also running Windows 10 (which version?), SOLUS 3 and Sophos Endpoint Protection (or not) with Intercept X and are successfully installing SIMS! We run Win 10 Pro and Edu, version 1703; did SIMS summer update and moved to Sophos Central and Int. X in the Summer. Can't recall which order we did most PCs, but def loaded further SIMS PC since with Int X already running with no sign of a problem.
kennysarmy Posted November 7, 2017 Author Posted November 7, 2017 Our case number with Sophos is : 7686724 If anyone wants to contact Sophos and update their case with ours...might put a bit more pressure on them if they see multiple sites with the same problem.
thatley Posted November 7, 2017 Posted November 7, 2017 Our case number with Sophos is : 7686724 If anyone wants to contact Sophos and update their case with ours...might put a bit more pressure on them if they see multiple sites with the same problem. I've just asked Atomwide to put more pressure on Sophos about this as I think this might just be the tip of the iceberg. I've referred them to look here too as I'm sure more people will come into this issue.
kennysarmy Posted November 7, 2017 Author Posted November 7, 2017 (edited) On the phone to SOPHOS - asking for an update! Nothing much to say - other than they have other customers advising of this edugeek link Edited November 7, 2017 by kennysarmy
deano3693 Posted November 7, 2017 Posted November 7, 2017 On the phone to SOPHOS - asking for an update! Nothing much to say - other than they have other customers advising of this edugeek link Yes i've just directed them here as well!
deano3693 Posted November 7, 2017 Posted November 7, 2017 We have tried adding various things to the exclusions to no avail. We also don't get any notification/error in Sophos but obviously it has been proved that Intercept X is causing the issue so all a bit weird.
kennysarmy Posted November 7, 2017 Author Posted November 7, 2017 We have tried adding various things to the exclusions to no avail. We also don't get any notification/error in Sophos but obviously it has been proved that Intercept X is causing the issue so all a bit weird. Exactly the same scenario here - nothing in the logs or alerts to suggest it's Sophos X as the culprit, but if you remove it from the PC - no issue!
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now