Sophos AV v2.20.11 and Opera 3 SQL

Hello Everyone,

One of our customers are using Sophos Endpoint Advanced as their Anti Virus software. This was all working fine until Friday when users starting experiencing speed issues (3-4 mins to open payroll processing).
I've been investigating and I've found that the speed issues are being caused by a Sophos update to v2.20.11 and when we switch off Network Threat Protection the speed issues disappear all together.

The speed issues are only present in areas which would be accessing SQL tables such as Payroll processing. Areas which access VFP table such as Company Profiles aren't experiencing any speed issues at all.

The normal AV exclusions are in place -
C:Pegasus
C:Program FilesPegasus
C:Program Files (x86)Pegasus
C:ProgramData Pegasus
C:ProgramDataApplication DataPegasus
C:Program Files (x86)Common FilesPegasus Shared
C:Program Files (x86)Common FilesMicrosoft SharedVFP
\servernameO3 Server SQL Static and Dynamic

There are also a number of automatic exclusions in Sophos excluding SQL Server file types.

Does anyone know of any AV exclusions which we might be missing? Or any that should be in place for SQL?

Thanks
Jodie

Find more posts tagged with

Pegasus - Partner General Discussions

Accepted answers

All comments

colin-avey

We have a site which has had problems with this advisory. I have not had notification it has been fixed from their IT. I think they tagged to be notified.

Advisory: Sophos Central Endpoint Self Help - Issues with Pegasus Opera3 web application caused by Modern Web

jodie

Hi Colin,

We did come across this but I didn't really understand it when it mentioned that there should be an exclusion added for the website application. They don't have PWX so would this still be applicable?

Thanks

Jodie

alan-bourke

That Sophos document is confusing - "should add a website exclusion for the Web Application server hostname/IP Address" - what web application server ? Unless it is the default Opera web page desktop that is causing issues.

colin-avey

The instructions in the Advisory have changed.
We basically had to disable a couple of the Sophos Modules on the affected machines.
The site doesn't have PWX and was slow opening forms

I will see if I can get any notes from their IT

colin-avey

Sorry, too early in the day.

The Resolution has been added since the workaround.

The Overview still contains the workaround in essence
Turning off both Real-time Scanning - Internet and Web Control allows the application to work.

We did this from the central control panel and created a group of machine to apply it to. Obviously less than ideal.

jodie

I logged the issue with Pegasus and they have responded with the following :

"We are not AntiVirus or Sophos experts but perhaps the following can work? It worked for a customer experiencing the issue, the IT said:

So it looks like the “Exploit Mitigation” element of Sophos Central is the thing that WAS causing us all the trouble.

I’ve added the full path “C:Program Files (x86)PegasusO3 Client VFPopera.exe” to be excluded and bingo all is working again.

The exclusion type must be set as “Exploit Mitigation (Windows)” for it to work.

This can be set at a very top level within the Global Settings or within the specific Threat Protection policy."

I'm going to contact their IT and give this a try, I'll let you know if it works.... fingers crossed!

Jodie

colin-avey

Thanks

Copyright © 2025 Infor. All rights reserved.