Page 1 of 1

Sophos blocking DNS with reason of "Memory Modified"

Posted: Sat Jul 06, 2013 8:04 am
by sj3vans
I have had 3 clerk computers (running Sophos) suddenly lose access to the Internet. Upon further analysis and calls to support, we found that Sophos is blocking DNS requests with a reason of "Memory Modified". One support person had me disable the firewall as a work around. Not good. I found that I was able to turn it back on by disabling the "Memory Modified" check. I'd rather not do that either but its better than running with no firewall. I thought that perhaps there was a virus but I have not been able to locate one with different scanning programs (aside from Sophos which is also not reporting anything else) nor am i seeing any other signs that there is one. Still something odd must be causing it as its only been seen on 3 units' computers (in different buildings). Any ideas? Thanks.

Re: Sophos blocking DNS with reason of "Memory Modified"

Posted: Sun Jul 07, 2013 8:36 am
by jtwitchell
May not be a big issue, but something to look at. Sophos recommends this: http://www.sophos.com/en-us/support/knowledgebase/29248.aspx to look and see what applications are causing the issue. I found it interesting that they said in the article "Disabling this feature will not compromise the endpoint protection level when suspicious behaviour has been enabled in Sophos Anti-Virus." Still, it is safer to check and maybe run a different antivirus as a check.

Re: Sophos blocking DNS with reason of "Memory Modified"

Posted: Mon Jul 08, 2013 10:07 am
by sokly
The Sophos KB provided by jtwitchell does provide the solution to the problem. Additionally, I would like to know what applicaiton is being blocked by Sophos to prevent DNS from working properly if you're able to find out.