Microsoft Outlook Application Crash due to UCRTBASE.DLL

I had a reply from Sophos to find out which Sophos component causes the crashes of Outlook, by disabling each Sophos component individually instead of disabling Sophos as a whole.

I wrote a simple VBA script using SendKeys() and some Sleep() commands to simulate:

• create a new e-mail
• write some lines in the body
• discard the e-mail

repeat that for 100 times.

With all Sophos components enabled, I can reproduce a crash of Outlook within about 25 tries.

With all Sophos components disabled, all 100 times are succesful.

But with a single Sophos component disabled, (I already tested: Files, Ransomware Detection, Exploit mitigation and Malicious Behaviour Detection) a crash of Outlook can still be reproduced within 1000 tries.

A few more Sophos components te go...

Did the exceptions for OUTLOOK.EXE and UCRTBASE.DLL stop the crashes?  I added the exceptions this afternoon (18, Jan 2021) but I will remove them again if this has already proven to be ineffective.

I had a reply from Sophos to find out which Sophos component causes the crashes of Outlook, by disabling each Sophos component individually instead of disabling Sophos as a whole.

I wrote a simple VBA script using SendKeys() and some Sleep() commands to simulate:

• create a new e-mail
• write some lines in the body
• discard the e-mail

repeat that for 100 times.

With all Sophos components enabled, I can reproduce a crash of Outlook within about 25 tries.

With all Sophos components disabled, all 100 times are succesful.

But with a single Sophos component disabled, (I already tested: Files, Ransomware Detection, Exploit mitigation and Malicious Behaviour Detection) a crash of Outlook can still be reproduced within 100 tries.

A few more Sophos components te go...

Sophos have replied with following request:

 1) Access the following folder: C:\Windows\System32\drivers\

    2) Rename hmpalert.sys to hmpalert.orig

    3) Reboot the computer.

    4) Test the issue and share result

    5) Revert the changes

    1) Access the following folder: C:\Windows\System32\

    2) Rename hmpalert.dll to hmpalert.orig

    3) Access the following folder:C:\Windows\SysWOW64\

    4) Rename hmpalert.dll to hmpalert.orig

    5) Reboot the computer

    6) Test the issue and share result

    7) Revert the changes

    1) Access the following folder: C:\Windows\System32\drivers\

    2) Rename savonaccess.sys to savonaccess.orig

    3) Reboot the computer.

    4) Test the issue and share result

    5) Revert the changes

Unfortunately, the crashes can go hours between occurences so thats a lot of reboots and waiting.

Latest test results with Sophos completely turned-off: no new crashes of Outlook.

I just created a support ticket by Sophos.

For the meantime I added

C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

and

C:\WINDOWS\System32\ucrtbase.dll

to the Global Exclusion list within Sophos Central, hopefully to prevent our users from getting annoyed by sudden crashes of Outlook.

At Microsoft support's request I have completely uninstalled and reinstalled Sophos on the affected computers.  Waiting to see if this actually resolves the issue, if not I will be implementing these exclusions myself.

Latest test results with Sophos completely turned-off: no new crashes of Outlook.

I just created a support ticket by Sophos.

For the meantime I added

C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

and

C:\WINDOWS\System32\ucrtbase.dll

to the Global Exclusion list within Sophos Central, hopefully to prevent our users from getting annoyed by sudden crashes of Outlook.