[sims] Sophos Intercept X preventing SIMS.net install on Windows 10

[kennysarmy]

Sophos advises to run process monitor capture:

 

https://community.sophos.com/kb/en-us/119038

[kennysarmy]

We just tried to capture the PML file on a PC with both Endpoing and Intercept installed expecting it to fail and the software now installs correctly!

 

Can anyone else verify the issue is resolved?

[IanMac]

Same issue here, just started happening on W7 clients. Will contact Sophos support.

[kennysarmy]

We just tried to capture the PML file on a PC with both Endpoing and Intercept installed expecting it to fail and the software now installs correctly!

 

Can anyone else verify the issue is resolved?

 

Not sure why that worked!!!

 

Tested again and it's still failing....

 

Now struggling to get get an FTP client to connect to them to upload the PML files

[kennysarmy]

Same issue here, just started happening on W7 clients. Will contact Sophos support.

 

Please also mention our case : number with Sophos is : 7686724

[IanMac]

Certainly will do thanks

 

- - - Updated - - -

 

Please also mention our case : number with Sophos is : 7686724

Certainly will do thanks

[kennysarmy]

Just been emailed this from Sophos!!!

 

Hello Jeff,

 

Just a quick email to see if there is an update on this case, I notice we have not heard from you since 08-Nov-2017. Please can you provide information regarding any developments with the case.

 

If you require any further assistance or clarification on advice that we've already provided then please don’t hesitate to contact us by telephone or email

 

Wtf????

I uploaded the sdu logs at around 5.30pm and it's the SEVENTH!!!

[SteveM555]

After some investigation I have another work around...

 

hmpalert.dll gets loaded into the processes when it fails to install. Simply renaming this temporarily during the install process allows SIMS to install and work fine afterwards. Simple batch script below for anyone needing it....

 @echo OFF
ECHO Disabling Sophos HitmanPro
RENAME C:\Windows\SysWOW64\hmpalert.dll hmpalert.dll.bak
RENAME C:\Windows\System32\hmpalert.dll hmpalert.dll.bak
ECHO Starting SIMS Installation
START /WAIT M:\Sims\Setups\SIMSInst.exe
ECHO Renabling Sophos HitmanPro
RENAME C:\Windows\SysWOW64\hmpalert.dll.bak hmpalert.dll
RENAME C:\Windows\System32\hmpalert.dll.bak hmpalert.dll
ECHO Finished.PAUSE

It disables HitmanPro, starts the SIMS installer and re-enables it afterwards.. Just change the path to SIMSInst in the script above. (Requires Right Click > Run as Administrator)

 

It's got us up and running for now until Sophos fix the issue.

Edited November 8, 2017 by SteveM555

[kennysarmy]

After some investigation I have another work around...

 

hmpalert.dll gets loaded into the processes when it fails to install. Simply renaming this temporarily during the install process allows SIMS to install and work fine afterwards. Simple batch script below for anyone needing it....

 @echo OFF
ECHO Disabling Sophos HitmanPro
RENAME C:\Windows\SysWOW64\hmpalert.dll hmpalert.dll.bak
RENAME C:\Windows\System32\hmpalert.dll hmpalert.dll.bak
ECHO Starting SIMS Installation
START /WAIT M:\Sims\Setups\SIMSInst.exe
ECHO Renabling Sophos HitmanPro
RENAME C:\Windows\SysWOW64\hmpalert.dll.bak hmpalert.dll
RENAME C:\Windows\System32\hmpalert.dll.bak hmpalert.dll
ECHO Finished.PAUSE

It disables HitmanPro, starts the SIMS installer and re-enables it afterwards.. Just change the path to SIMSInst in the script above. (Requires Right Click > Run as Administrator)

 

It's got us up and running for now until Sophos fix the issue.

 

 

Not sure how we would integrate this with deploying out using SOLUS 3....

[kennysarmy]

Update from SOPHOS on my call:

 

Hello Jeff,

 

Good morning

 

I have received the logs and I will now escalate this case to next level for further investigation.

 

Regards,

 

Bhavani Shankar

Sophos Technical Support

https://www.sophos.com/en-us/support/contact-support.aspx

 

Support Knowledge Base: https://community.sophos.com/kb

Follow us on Twitter @SophosSupport

Sophos Community (discussion forums): https://community.sophos.com

 

SOPHOS - Security made simple

[thatley]

I was told that yesterday that our call has been escalated to "Platinum Support".

 

Can't see this being resolved any time soon - just seems to be us lot coming up with workarounds.

 

We'll see.

[thatley]

Also, not sure if any of you use FMS, but this fails at exactly the same point (run FMSINST.exe manually and you'll see the same as running SIMSINST.exe manually). Just at the "Prerequisites" part when it says it's going to install Adobe Reader X (even though we have Adobe Reader DC on our clients!) It just hangs there. Works fine with Intercept X disabled.

 

Anyone seen this?

Edited November 8, 2017 by thatley

[kennysarmy]

Also, not sure if any of you use FMS, but this fails at exactly the same point (run FMSINST.exe manually and you'll see the same as running SIMSINST.exe manually). Just at the "Prerequisites" part when it says it's going to install Adobe Reader X (even though we have Adobe Reader DC on our clients!) It just hangs there. Works fine with Intercept X disabled.

 

Anyone seen this?

 

I've done a normal process monitor on a working and non working PC - just comparing the outputs now - but there is a lot of data to go through!

[thatley]

I've done a normal process monitor on a working and non working PC - just comparing the outputs now - but there is a lot of data to go through!

 

Yes, Process Monitor is pretty full on!

[thatley]

Just for information - just looked here to look at the release notes/components table - Sophos Intercept X Open the "Version 11.5" dropdown.

 

HitmanPro.Alert was upgraded from 3.6.8 to 3.6.9 in October, which is when this started happening to us (about half-term time).

 

I've requested if there is anyway for them to roll back our instance to 3.6.8 to test. Awaiting response.

Edited November 8, 2017 by thatley

[kennysarmy]

SIMSApplicationSetup.exe just seems to STOP!

 

[thatley]

Yes, that's exactly where ours stops Kenny - so frustrating!

 

Just been told that Sophos are still looking at all the logs, so no developments yet.

[kennysarmy]

Sigh!

 

[thatley]

Really?

[thatley]

Just tried that suggestion just for my sanity - SIMS/FMS still won't install.

[kennysarmy]

Surprise surprise that did not work!

[deano3693]

Just hold the party line - We've proved its the Hitman Pro service causing the issue and they need to sort it!

[kennysarmy]

Just hold the party line - We've proved its the Hitman Pro service causing the issue and they need to sort it!

 

Agreed, I've fired off Nine emails to them today to apply pressure, will be a call in the morning too....

 

I've also asked if our HitmanPro Service can be rolled back to the previous version for testing...

[speckytecky]

Jeepers! I'm now so glad that the Dell PC our F&BM uses failed to update to W10 from W7 recently - the pre-upgrade check reported there'd be a graphics driver issue on the year-old Dell if it was up[graded to I held fire.

Also, not sure if any of you use FMS, but this fails at exactly the same point (run FMSINST.exe manually and you'll see the same as running SIMSINST.exe manually). Just at the "Prerequisites" part when it says it's going to install Adobe Reader X (even though we have Adobe Reader DC on our clients!) It just hangs there. Works fine with Intercept X disabled.

 

Anyone seen this?

[kennysarmy]

Interestingly I did a test where I installed Intercept X but disabled the HitManPro Servce - and the installation did not complete properly - what that means I'm not sure!