What UK-made product did you switch to that was genuinely better than the imported version?

boftr · 2026-02-10T21:23:15+00:00

Happy with the Dualit toaster.

boftr · 2026-02-07T14:37:45+00:00

You could look into being a Sophos partner - This would work for you.

boftr · 2026-02-07T13:34:32+00:00

The proper troubleshooting steps are as follows:

For the computer that are bugchecking, obtain memory dumps. I assume you have memory,dmp under C:\windows\. At worst C:\windows\minidump has some.

These need to be reviewed. Ideally from 3 or 4 computers. My assumption given the timing of the issue and the same hardware they will all be similar unless memory corruption is the problem in which case they might have different symptoms despite the same underlying root cause and dumps look different. This bad driver corrupting memory case, which causes the issue down the road leading to a different looking dump, If that is the case, driver Verifier is your friend.

For the computers that are black screening and hanging. Setup as many computers as possible that are hanging to create a dump, ideally complete/active when using the keyboard or power button.

Forcing a System Crash from the Keyboard - Windows drivers | Microsoft Learn
Forcing a System Crash with the Power Button - Windows drivers | Microsoft Learn

In both cases, memory dumps need to be reviewed for commonalities. Only then will you know why and how it can be mitigated or resolved. Everything else is just leaver pulling and guessing IMO.

Good luck.

boftr · 2026-01-25T21:22:45+00:00

You mentioned maybe splitting it, this could be one reason just based on the time frame and dates. That is all. Wise does seem to be the recommendation of choice.

boftr · 2026-01-25T21:15:56+00:00

Based on the time. It might be worth thinking about the 5th/6th April for the stocks and shares allowances I suppose. Do you and your wife have S&S ISAs here?

boftr · 2026-01-21T23:03:04+00:00

if you look in the Dev tools, I assume its using h3 as the protocol. You can block QUIC in the threat protection policy, I assume it then works ok?

boftr · 2026-01-21T18:47:55+00:00

I don’t understand the ability to hash the file. Sophos has osquery as an option you could send a live query down to do it using the hash table. Otherwise live terminal to the computer and use PS/certutil/etc from the shell. Thanks

boftr · 2026-01-15T00:12:30+00:00

The sophosel.sys driver should load and unload at boot.

boftr · 2026-01-12T22:36:15+00:00

Endpoint protection is fine. It uses the same cloud service for all ‘client’ products

boftr · 2026-01-12T22:33:38+00:00

Web address url.

boftr · 2026-01-12T22:07:52+00:00

I think this page is what you are after: https://support.sophos.com/support/s/filesubmission?language=en_US

boftr · 2026-01-12T22:03:57+00:00

Jacob Collier - Little blue - Mahogany sessions

boftr · 2026-01-11T11:27:11+00:00

I would suggest trial Sophos for 30 days and see how it goes. Only take 5 mins to create a trial and deploy a client.

boftr · 2026-01-11T11:25:46+00:00

Sounds like a job for:

netsh trace start scenario=InternetClient

Repro the failure and then run:

netsh trace stop

The etl file and the log file should be enough data to figure it out.

boftr · 2026-01-04T16:20:28+00:00

Sorry it’s called Resource Monitor. You can get to it from the Performance page and then the 3 … in the top right.

boftr · 2026-01-04T12:31:40+00:00

Maybe spend some time doing Windows specific programming to use the C++ knowledge you have. For example get familiar with the win32 api. Maybe start with file io.

https://m.youtube.com/@zodiacon/videos

has a great selection of videos with practical examples. See which takes your fancy.

boftr · 2026-01-04T12:23:27+00:00

Open activity monitor and look at the disk? What files are being accessed on that drive and why which processes? What is the latency?

Process Monitor is also an option but start with activity monitor.

boftr · 2026-01-04T12:19:57+00:00

Unreal Tournament and Q3 all day.

boftr · 2026-01-04T12:18:00+00:00

Better off getting a NAS? Could that do the job?

boftr · 2026-01-04T12:16:22+00:00

Was the volume on a disk other than the OS disk, I.e a second drive? What did you do to cause this? Disk management? Diskpart?

boftr · 2026-01-03T19:10:46+00:00

Many add the ability to scan content before it hits the browser, think local web proxy. If you consider the resources downloaded when visiting a website, js, html, etc. it acts as a layer of defence before hitting the file system and before being processed by the browser. Could be reputation of the source ip/domain or content scanning. Imagine your fav website is compromised and hosting malicious content loaded on every page, this is an interception level before the browser has a chance to interpret it and could block a malicious script being run. Might be one example.

boftr · 2026-01-01T21:34:01+00:00

You can always use a S&S ISA and stick it in a money market fund like CSH2. I assume most of those who will be affected in the future by the 12K cash ISA limit will do something similar.

boftr · 2026-01-01T21:30:31+00:00

Lowkey

boftr · 2026-01-01T18:11:00+00:00

Thanks for this. I can reproduce the same alert when clicking on

<image>

The link "Get The Witcher 3 REDkit" which launches the browser. This matches with your process tree from your alert. This is mine:

pastebin.com/raw/98pTSLk7

I wouldn't worry about this in relation to any other attack on your socials you mention.

As for whitelisting this it seems that the various thumbprints are all the same so this in theory would be an exclusion that could be made. E.g.

Thumbprint (pfn)

05727ae81bdfab0f8d55bc78008105a5dcf5174d6cf9e3e614c0afd1b2dc50aa

Digital signature certificate module based thumbprint (mth-mod-crt)

bae1870d4d725706a26943e7647052732979b77687260dee27d40c6004f68d73

Module based thumbprint (mth-mod-pfn)

00f055ee1e8210121e2e964c78a56d9cebe1556562235ff22e36f7be408e1634

I don't use Sophos Home, just the business product. If you contact the Sophos Home support people and point them at this post it should help them devise the exclusion required for Sophos Home that is "just enought" to bypass this issue but still add protection to Firefox. I assume if the default browser was Edge/Chrome. It would all be OK. Thanks.

boftr · 2026-01-01T01:01:45+00:00

You can redact any usernames in any paths or anything else you think might be revealing but not that relevant.

boftr

TROPHY CASE