malware

We use Sophos but have not had any detections for Smoothwall and all Smoothwall paths are whitelisted, and thinking about it in my testing I completely removed Sophos and it didn't make a difference. Interesting find, I don't have the Edge log files near me to review at the moment but this definitely could cause it.

Hi Tom, Thanks for your quick reply. In the Edge logs it shows that the extension I presume is trying to talk to the unified client, it tries for around 112 seconds before throwing ERR_CONNECTION_REFUSED and then the sites load. { "params": { "initiator": "chrome-extension://dlcaglefdlidioooijnigjhfcndlncfp", "method": "POST", "url": "http://127.0.0.1:5769/companion.CompanionApi/RegisterCompanion" }, "time": "240250", "type": 134 } I will DM you the ticket number.

Hi all, Just checking if anyone is in the same boat as us, for the past couple months we've had a few reports of websites not loading for a couple mins on first boot but after it has loaded everything is fine. I think I have pinpointed the issue to being the smoothwall cloud filter extension not being able to communicate with the unified client and causing it to hang. If I bypass the extension everything loads fine, is anyone else experiencing this? I'm waiting on Smoothwall getting back to me. Thanks!

Hi all, I'm having a strange issue that I'm desperate to wrap my head around! On freshly imaged new Dell W11 24H2 4349 machines, I'm seeing an error in event viewer saying it cannot find windowsstartexperience, however the folder exists in C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy (version 10.0.26100.4202) and the start menu functions as expected. I even noticed this on a machine that wasn't imaged via SCCM, so it's not specific to a corrupt image or anything. If I run Get-AppxPackage *StartMenu* -AllUsers it shows it's installed. If I run Windows Update on the machine and allow it to download either 4851 or 4946 there is no start menu and the desktop is blank, you can still open task manager, run a task like msedge, download something and open the download folder and file explorer will open just fine no issue. In this state, if I run that same command as above, it shows that StartMenuExperienceHost is not installed or Installed (Pending Removal)? The folder is still in SystemApps but the version (10.0.26100.4768), AppxManifest.xml are all updated so something has changed during the update to that folder. If I get another fresh imaged machine, and before running any Windows Updates I run this command: Get-AppxPackage -AllUsers | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"} Then it updates just fine and works, if anyone has any clues that would be awesome! Thank you

I saw this on the Microsoft forums: https://learn.microsoft.com/en-us/answers/questions/2280466/windows-11-mandatory-profiles-start-menu-not-worki If it's really no longer supported that would be concerning haha.

Looks like the August update didn't fix it for us unfortunately, have you had any further luck on this? I would really appreciate it! Regretting going to 24H2 now haha.

Thanks for your reply. Yep, I've decided pausing automatic updates and rolling back the problem update is the answer rather than pushing a preview update and will wait for the release in a couple weeks to test. If anyone else has the issue, this is the script I'm running, it detects the KB you specify and uninstalls the package you specify. # --- CONFIGURATION --- $kbId = "KB5062553" $packageName = "Package_for_RollupFix~31bf3856ad364e35~amd64~~26100.4652.1.20" # --------------------- try { # Check if the update is installed Get-HotFix -Id $kbId -ErrorAction Stop Write-Host "Update $kbId found. Proceeding with uninstallation." # If found, run the uninstallation command try { $arguments = "/Online /Remove-Package /PackageName:$packageName /Quiet /NoRestart" Write-Host "Executing: DISM.exe $arguments" Start-Process "DISM.exe" -ArgumentList $arguments -Wait -PassThru Write-Host "SUCCESS: Uninstallation of $packageName completed or scheduled." exit 0 } catch { Write-Error "FAILED: An error occurred during DISM execution. Details: $_" exit 1 } } catch { # This block runs if Get-HotFix fails, meaning the update isn't installed Write-Host "SKIPPED: Update $kbId is not installed. No action taken." exit 0 }

It never finishes, I think it's because Windows is waiting for the taskbar to start which it can't because it's faulting. Yes all devices have driver packs created via Dell Command in SCCM, I don't see any drivers installing when that problem update installs but it's not something we actively disable.

Hi all, This summer we are imaging all new devices with Windows 11 24H2 OS Build 26100.4349 (Dell Pro devices) via SCCM with the driver packs from Dell Command. They all work fine, but when running Windows Update (OS Build 26100.4652) and restarting it gets stuck on 'Preparing Windows' when you try to login, if you Ctrl + Alt + Del then it loads up but you can only see your mouse pointer and everything else is black. There have been a few times it has 'fixed' but I'm not sure if it's just fluke or something else is happening, we use mandatory profiles, I've tried a local admin account also which sometimes work, but not always. I've tried: running sfc /scannow dism /online /cleanup-image /restorehealth Deleting all of the packages in local appdata Deleting profiles Turning off applocker Disabling Sophos Disabling Smoothwall We have noticed some desktops have fixed when manually installing the latest update (2025-07 Cumulative Update Preview for Windows 11 Version 24H2 for x64-based Systems (KB5062660) (26100.4770)), but I haven't tried it on a big enough pool of devices yet to know for sure, I can't see much online about it so worried it's a configuration issue somewhere. I'd love to know if anyone else has experienced this and what they did to resolve it, we have thousands of devices so it's a bit of a nightmare. Opening up task manager and trying to run explorer.exe OR pressing the windows does nothing, checking event viewer shows: Problem Details Problem: Windows Start Experience Host Description: Stopped working Date: 25/07/2025 10:03 Status: Report sent Faulting Application Path: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe Problem signature Problem Event Name: MoBEX Package Full Name: Microsoft.Windows.StartMenuExperienceHost_10.0.26100.4768_neutral_neutral_cw5n1h2txyewy Application Name: praid:App Application Version: 10.0.26100.4768 Application Timestamp: 61de637a Fault Module Name: StartMenuHost.dll Fault Module Version: 10.0.26100.4768 Fault Module Timestamp: 919e7523 Exception Offset: 00000000000ffe6d Exception Code: c0000409 Exception Data: 0000000000000007 OS Version: 10.0.26100.2.0.0.256.121 Locale ID: 2057 Additional Information 1: 23f4 Additional Information 2: 23f433b5363112671f353cae94b59b8a Additional Information 3: 7937 Additional Information 4: 79378fb4fd0bb45ddfed06ea4f0ca029da Extra information about the problem Bucket ID: 67e12a638bc7cf8f5a3b6c2a39f28019 (0) ----------------------------------------------------------- Problem Details Problem: Windows Logon User Interface Host Description: Stopped working Date: 25/07/2025 08:30 Faulting Application Path: C:\Windows\System32\LogonUI.exe Problem signature Problem Event Name: BEX64 Application Name: LogonUI.exe Application Version: 10.0.26100.4202 Application Timestamp: 8ed3eebb Fault Module Name: Windows.UI.XamlHost.dll Fault Module Version: 10.0.26100.4202 Fault Module Timestamp: e941334f Exception Offset: 0000000000007922 Exception Code: c0000409 Exception Data: 0000000000000007 OS Version: 10.0.26100.2.0.0.256.121 Locale ID: 2057 Additional Information 1: cba7 Additional Information 2: cba7c3f99593f456a2fd946d7ba108447 Additional Information 3: 1900 Additional Information 4: 190095246be723a043309671f53bdece Extra information about the problem Bucket ID: 81087e5e778acd4ad346a3da6adffa3c (0) ----------------------------------------------------------- Problem Details Problem: Windows Explorer Description: Stopped working Date: 25/07/2025 09:28 Status: Report sent Faulting Application Path: C:\Windows\explorer.exe Problem signature Problem Event Name: BEX64 Application Name: explorer.exe Application Version: 10.0.26100.4768 Application Timestamp: 6e2489c5 Fault Module Name: explorer.exe Fault Module Version: 10.0.26100.4768 Fault Module Timestamp: 6e2489c5 Exception Offset: 00000000000bd964 Exception Code: c0000409 Exception Data: 0000000000000007 OS Version: 10.0.26100.2.0.0.256.121 Locale ID: 2057 Additional Information 1: 3e45 Additional Information 2: 3e45509b1f7017d6893bda024500b63e Additional Information 3: baef Additional Information 4: baef64f9367fd2555742acc0fd8e0754 Extra information about the problem Bucket ID: 2875555545634ce4ae24a3e52b3bd323 (0)

We have just tried moving the device into an OU with no GPOs applied and that seems to have fixed it, so I think it might just be a process of elimination now? Something not happy with Sophos/Windows 11/Smoothwall.

At first I was reusing Win 10 drivers and letting Windows Update grab the rest, but after the issue I used Dell Command to grab the latest Win 11 drivers but didn't fix it for me. Yeah only seems to be Dell that have the issue, but we have many models, OptiPlex 3000/3020/3080/7010 SFF/7010 Micro and many Lattitudes too!

Everything works fine until Windows Update is run, and then everything really slows down. Trying to open any software tends to take like 1-5 minutes sometimes! It's completely unusable.

I have a software stack step that is just another task sequence with install application steps, thats how I installed ESET before, are you saying I can't do it this way?

Hi all, We are rolling out Windows 11 to our devices, imaging with a SCCM task sequence, we're having a strange issue that we're stumped on and wondered if anyone else has had the issue. Once the imaging is finished, everything works fine, as soon as you run a windows update and then restart everything becomes unusable and applications take a long time load (although sometimes File Explorer/Edge/Windows Apps run fine). When you check Sophos it says there is an issue with the ML Engine, and trying to update just keeps failing, I ran a gpupdate and then everything improved, sophos could update and apps began to open normally (I'm not sure if this was causation or correlation). Windows 10 works fine no problem, it's only a combination of Windows 11 and Sophos, it's almost like Sophos is making things run slowly because it can't scan them? Just a guess.

Apologies, not sure why the format looked like that.. Let me try and fix that: https://www.bamsoftware.com/hacks/zipbomb https://amongussussybaka.org https://lq16.democrat https://simplescience.design https://rhodiumub.dev https://goodsciencehelp.com https://goodsciencehelp.xyz https://greathomeworkhelper.com https://thiswasonlyadollar.xyz https://builtincryptominer.com https://crownjs.anirudhiscool.repl.co https://nicecollege.org https://epicedufinder.org

Hi all, I have infiltrated a lot of communities to make sure I'm blocking the latest sites for my trust, so thought I'd start to bring you the latest URLs to block! Smoothwall seems to block a lot more sites than Lightspeed but these still got by: https://epicedufinder.org/https://nicecollege.org/ https://www.bamsoftware.com/hacks/zipbomb/https://amongussussybaka.org/https://lq16.democrat/https://simplescience.design/https://rhodiumub.dev/https://goodsciencehelp.com/https://goodsciencehelp.xyz/https://greathomeworkhelper.com/https://thiswasonlyadollar.xyz/https://builtincryptominer.comhttps://crownjs.anirudhiscool.repl.co/ Will create a thread when I get another healthy amount, usually monthly.

Our main concern should be staff absences, reducing this to 5 days if they test negative on day 4 and 5 is vitally important. I have noticed a lot of doomsayers on this forum, I, along with many of us, also have family that work on the covid wards and they each seem to have their own anecdotal experiences based on community transmission etc, I live in the Midlands, all I have heard is Omicron is a blessing in disguise.

They've made the change because a sizable amount of people will test negative on the 5th day (whether it be because they took longer to test initially, or because of their immune system), I don't know a single person that thinks this is a bad idea unless they just like to hate the government for the sake of it. As you say, 2 negative LFTs are still required!

ESET Cloud Security is top notch and now has support for 365 applications including anti-phishing. Not cheap though

Pass lol. We have had it setup for less than 2 weeks so I cannot tell you yet, pretty sure it is the default setting though. Have a read here for a possible solution. I will keep an eye on it now as I was unaware they could keep hitting cancel. Deployment considerations for Azure AD Multi-Factor Authentication | Microsoft Docs

In Azure, you can go into Conditional Access, create a new policy and enable MFA in the Grant settings and in the Users and groups' click the 'Select users and groups' radio button, then users and groups checkmark and add your groups that way. So that way we just add the staff groups and not the ones with students.

Yes that is correct. You mean they can keep clicking cancel even after the 14 day grace period? This is for O365.

Both quick AND easy to setup, we didn't use their templates. They have a feature where you can enter a URL and they will rip the page and make it useable in the campaign, for us though, I sent myself a OneDrive shared file email and then recreated that as this is a common attack vector used by these people. Added a few spelling mistakes here and there and when they clicked on the link to view the shared file it took them to a Google login (This should have been a major red flag) but we had a fair few people within 5 mins click the link and even enter personal email/pass for Google! We've tried a lot of things to educate our staff but everything has seemed futile, so now we're forcing MFA and have a banner across every external emailing warning them not to click on links.

Yes we have run a few and its surprising the amount of people that fall for it, I even try to make it less convincing but they still fall for it haha. We use gophish but there are a few others. We do not actively tell them it was a phishing campaign, just change their password and run an AV scan on their system and hope that the inconvenience caused by this will make them be more careful in the future.

I think I might implement this when teachers fail our phishing campaigns!