Blocked by Sophos Endpoint Agent (antivirus software)

[lchien]

I have been playing Assassin's Creed Origins for around 16 hours, but someday when running it through Steam, a tiny window popped out from the bottom-right corner, showing:

'HollowProcess' malicious behavior prevented in x64launcher.exe

I realized that this window came from the antivirus software called Sophos Endpoint Agent. I tried to turn it off temporarily, but there was no setting tab to do so in the software. I am unable to uninstall it because of some reasons. I googled solutions for several days but still got no clue. Hopefully, anyone here can help from the forum. Any suggestions will be appreciated.

[animal_PLANET]

That is part of steam. Are you running any mods? It may cause a false positive. Or it can mean your definitions are out of date or product needs to be updated.

If you do not have a subscription or using an outdated version and want to uninstall. Read this link.
https://support.home.sophos.com/hc/en-us/articles/115005494583-Uninstalling-Sophos-Home-on-Windows-computers

There are a lot of articles directing you to how to also exclude apps or directories on the support site for Sophos. This will prevent the false positive from being detected.

Here is a link for the home version which I am assuming you are using to exclude files or folders.
https://support.home.sophos.com/hc/en-us/articles/115005499966-Setting-scan-exceptions

If you need more help look at more options under support or contact Sophos.

[lchien]

I do not install any mods. This problem only happens in this game. All of my other games do not suffer this problem. I have found a way to not execute Sophos without uninstalling it, but this way still does not work. It is disappointing because this is my first game in Assassin's Creed series. It did not run well in my old laptop when I purchased it last year. After 1-year waiting for a better new laptop, this game only worked for 16 hours. But no matter what, I pretty much enjoyed it when playing it. Feel very sad but need to give this game up.

Originally posted by animal_PLANET:

That is part of steam. Are you running any mods? It may cause a false positive. Or it can mean your definitions are out of date or product needs to be updated.

If you do not have a subscription or using an outdated version and want to uninstall. Read this link.
https://support.home.sophos.com/hc/en-us/articles/115005494583-Uninstalling-Sophos-Home-on-Windows-computers

There are a lot of articles directing you to how to also exclude apps or directories on the support site for Sophos. This will prevent the false positive from being detected.

Here is a link for the home version which I am assuming you are using to exclude files or folders.
https://support.home.sophos.com/hc/en-us/articles/115005499966-Setting-scan-exceptions

If you need more help look at more options under support or contact Sophos.

[Ubi-Thrupney]

Originally posted by lchien:

I do not install any mods. This problem only happens in this game. All of my other games do not suffer this problem. I have found a way to not execute Sophos without uninstalling it, but this way still does not work. It is disappointing because this is my first game in Assassin's Creed series. It did not run well in my old laptop when I purchased it last year. After 1-year waiting for a better new laptop, this game only worked for 16 hours. But no matter what, I pretty much enjoyed it when playing it. Feel very sad but need to give this game up.

Hey Ichien, thanks for coming back to us about this! I understand Origins is showing a false positive in your antivirus software.

Our developers are not aware of any specific issues with Origins that would cause a false positive with any antivirus software. Our usual advice is to disable any background processes which might cause a conflict, but I understand you are unable to do this.

I'd echo Animal Planet's advice - they've very kindly linked some guides which will help you to add an exception for the game to your antivirus. If that doesn't work, please reach out to the developer of the antivirus for further assistance.

I'm confident any modern antivirus program will have some way to whitelist a program in cases of false positives - this will allow you to continue with the game. It's good to hear you were enjoying it

My apologies that I'm not able to help more directly with your antivirus program. Since it isn't something we've developed, our best advice is to ask its developer for assistance. That said, I'll be interested to hear how it goes for you if you do contact them!

- Ubisoft Support

[bsimmons]

I'm getting the same thing when I try to run Company of Heroes. Sophos says it's detecting a HollowProcess exploitation attempt involving Steam 1.0, and terminates Steam. But it doesn't do this when I run Steam.exe. It only does it when I try to start Company of Heroes. I tried running Just Cause 2, and that works fine. Haven't tried anything else yet. Weird.

[animal_PLANET]

Originally posted by bsimmons:

I'm getting the same thing when I try to run Company of Heroes. Sophos says it's detecting a HollowProcess exploitation attempt involving Steam 1.0, and terminates Steam. But it doesn't do this when I run Steam.exe. It only does it when I try to start Company of Heroes. I tried running Just Cause 2, and that works fine. Haven't tried anything else yet. Weird.

Read my comment above. If it doesnt help open a new thread on the company of heroes forum. https://steamcommunity.com/app/228200/discussions/

[76561198885856812]

Hello bsimmons,

Thanks for reaching out and I'm sorry to hear that you are receiving the false-positive report.

Have you tried whitelisting your game with the antivirus, as @animal_PLANET and @Ubi-Thrupney suggested, by any chance?

Many thanks and if you have any additional questions, please let us know.

- Ubisoft Support

[neineR]

I'm getting this while launching dota 2 and I cannot whitelist anything because this is my company's laptop lol so is there any way to bypass it?

[Ubi-Vinci]

Hey neineR,

Sorry to hear it, however, this forum does not concern DOTA 2.
Please look up and use a correct forum for this title.

For a company laptop where you probably do not have admin permissions, I would advise you to contact your IT department.

I'm closing this thread now.