Spontaneous reboot on send/receive

[russellhltn]

After some testing, it's seems to be a solid confirmation. MLS and Sophos firewall do not play well together. Attempts to do a send/receive via modem will result in the system hanging at “Authentication Completed”. At that point you'll gradually lose control of the machine and be forced to power off.

Fortunately the file I was given by LUS to uninstall Sophos is a BAT file. A bit of editing allowed me to keep the Anti-virus while removing the troublesome firewall.

Still not sure what caused my original problem. It did get past the “Authentication” message before, and uninstalling Sophos didn't fix it. But gave up trying to fix that system. I could then use the WinXP firewall.

However having two machines hang at “Authentication” tells me that we can't use dial-up as backup in case broadband fails. At least not with the current version of MLS (3.5.1). This may be a wide-spread problem.

[russellhltn]

Got a ward whose computer (WinXP SP3) does a spontaneous reboot when you try to send/receive. I've already tried installing MLS overtop. I haven't exhausted my bag of tricks, but I wanted to see if anyone else has seen this.

Lighting strikes again. A different ward's computer died right when it upgraded to MLS 3.6. It does a reboot a few seconds into "preparing data". Digging deeper, it's the same BSOD with DRIVER_IRQL_NOT_LESS_OR_EQUAL, stopping at D1.

It's never been connected to the Internet. It's only been dial-up. But the fix was the same - uninstall Sophos firewall and replace it with the Windows Firewall. In this case, it was real easy. This is the older Sophos - just uninstall the firewall from the usual Uninstall window in Control Panel.

So far, all the affected computers have been OptiPlex 740s installed in 2008.

[Sokly]

My name is Sokly Vann and I am the Operations Engineer responsible for Sophos. I like to get additional information about this issue. One of the ways is getting some diagnostic information from the box. If can replicate the issue please follow this Sophos KB http://www.sophos.com/en-us/support/kno ... 33533.aspx and create me a log file and email it to me @ sokly@ldschurch.org and I will get it to Sophos to analyze.

[bfromm]

I also want to confirm that this is NOT a common issue (it's the first time I've heard of it happening). I have a number of 740s in my stake, all using "internet" as the connection type, and none of them have the problem. If I had to guess, there's something going on with the existing state of the computer (years of patching, different versions of tools and apps, etc.) that is creating the perfect storm for this to occur. I would really like to get the log information Sokly asked for to see if we can track down something specific on the Sophos side. I would also be happy to get you the image for that machine so that you can re-image it. I just re-imaged a 740 on Monday, and it feels like a new machine!

[Biggles]

My name is Sokly Vann and I am the Operations Engineer responsible for Sophos. I like to get additional information about this issue. One of the ways is getting some diagnostic information from the box. If can replicate the issue please follow this Sophos KB http://www.sophos.com/en-us/support/kno ... 33533.aspx and create me a log file and email it to me @ sokly@ldschurch.org and I will get it to Sophos to analyze.

Using the quote from RKAT site - Desktop Security Software implies that you should follow this procedure when submitting any log files!

Note: If you believe Live Protection has found a possible virus, and a Sophos support agent asks for a copy of the log file, that file must first be reviewed by the Church client-side operations team to make sure no confidential information is included. You will need to work with the Global Service Center (GSC) to determine the best course of action. If needed, the GSC will directly engage the client-side team.

[russellhltn]

I have a number of 740s in my stake, all using "internet" as the connection type, and none of them have the problem.

Just for kicks and grins, unplug it from the network and try to use dial-up. This problem only appears when using dial-up. If I plug it into broadband, it works just fine.

Since the stake machine is the most accessible to me, I'll verify that there's still a problem and use that one for the logs.

[russellhltn]

Since the stake machine is the most accessible to me, I'll verify that there's still a problem and use that one for the logs.

The stake machine has slightly different symptoms. It gets as far as "Verifying user" and then the CPU goes to 50%, the mouse stops responding and a few seconds later Task Manger stops updating.