Explorer Crashing (DEP)

[Michael]

I've opted for:

 

2. disable the scanner globally using a domain group-policy

 

I presume I set the value as 0 to disable the add-on? Then when v7.6.1 is released I can remove this policy?

[mattx]

Oh dear, don't tell me Sophos is causing yet MORE problems ????

Oh dear, oh dear, oh dear, oh dear.....

[sab_sophos]

Hi all - - yes, the 7.6.1 main update should contain the fixed version. '7.6.0 RC2' is the workaround - switching the web-scanner 'off' by default.

 

Yes, as Michael says, switching it off using the domain policy will also mean that you don't need to go to the RC2 package, so that might be simpler - it's up to you. (yes, please set it to '0, the add-on is disabled for all users of this computer', and remove the policy when 761 comes out).

 

Re. these problems - sorry everybody.

Edited October 6, 2008 by sab_sophos

[Michael]

Yes, as Michael says, switching it off using the domain policy will also mean that you don't need to go to the RC2 package, so that might be simpler -

 

Thank you for clarifying this. I made the GPO change on the Default Domain Policy as it affects all workstations and servers running Sophos. So long as policy inheritance is enabled (which it is by default) all machines should pick up the new policy very quickly.

[browolf]

I've opted for:

 

2. disable the scanner globally using a domain group-policy

 

I presume I set the value as 0 to disable the add-on? Then when v7.6.1 is released I can remove this policy?

 

 

where's that?

[markwilliamson2001]

You need to add a new Group Policy Object through Active Directory. I would put it on the domain root (i.e. domain.local). I have called mine FIX SOPHOS!

 

You then need to edit the GPO with the following settings:

 

Computer Config...Admin Templates...Windows Components...Internet Explorer...Security Features...Add On Management...Add On List

 

Click Enabled Button...Then Show Button below.

 

You then need to follow Sophos instructions to add the new "add-on" and disable it.

 

HTH

Mark

[sab_sophos]

Hi Bro,

 

This link - Sophos Anti-Virus for Windows 2000+: Data Execution Prevention message displayed when closing Windows Explorer gives the four options under 'What to do':

 

* Disable Web Content Scanner BHO locally (Sophos kb 36265)

* Disable Web Content Scanner BHO centrally (kb 45206)

* In EM Library subscribe to the fixed RC2 package (same kb, 46484)

* Disable Explorer.exe from loading Web Content Scanner BHO (same kb)

 

So the domain policy is the second of the four options. If you only have a few machines affected, it's easiest to go for the first or fourth option. For more machines, the second or third.

 

Simon B.

Sophos support.

[mike671]

I have seen this DEP and multiple explorer crashes on three different laptops in the past day. Two are brand new, clean XP Pros with no software installed, just an OS and all windows updates. The Explorer errors began after Windows Updates.... Thanks.

[jjohnsoncantell]

I dont think this is sophos guys...

 

I read this thread originally the other day and agreed with the idea that sophos was causing this, the majority of people reporting this fault to me do after all have sophos installed. However,

 

I have a test machine in my office which until a week ago had windows xp with sp3 and it had no problems for the 3 months it had been running for. It was rebuilt a week ago and my wsus server reports its now 100% up to date and already today it has had this DEP error 5 times using different programs. This machine has never had sophos installed on it.

 

Therefore i can only assume, one of the updates released in the most recent patch day has caused this DEP error as this machine is only a week old, and the previous incarnation had been kept fully up to date with no issues.

 

If theres any more info on what causes this or a fix i'd love to know as i have near on 500 machines which could be affected by this problem.

 

james

[mike671]

I know for a fact it's not just Sophos. NONE of this machines I've seen this on (five now in the last few days) have Sophos installed or ever did. I as well have hundreds of PCs to keep track of. They have to figure this out???

[jjohnsoncantell]

It doesnt seem to be program specific either, ive had someone tell me paint crashed on them with a DEP error, some were just using internet explorer, media player, just seems random.

 

Im just hoping MS arent stupid enough to release an update that could cause this to happen as DEP is integrated into windows and short of setting up a massive list in the programs to exclude from DEP i dont know what to do.

[ZeroHour]

In EM Library subscribe to the fixed RC2 package (same kb, 46484) .

Whats the recommended procedure for this?

When I switch to 'central' for the databank a IDE's only package is listed but not SAV + IDE's?

Should I override the current update location or create a fresh?

[Michael]

Since I've implemented the fix at all my sites, the DEP problems have gone away (touchwood) and all are running Sophos.

 

Sophos have also claimed responsibility that v7.6.0 does create DEP errors and that it'll be fixed in v7.6.1 officially.

 

As for other applications causing DEP errors, check the event log. It can give a clue as to where the problem might be. In saying that though, originally I thought it was something Windows specific as explorer.exe is one of the key processes, but of course all applications rely on this process.