Quartus did not start

I should also ask - is anyone is running CyberArk in addition to Sophos?

Updated the Sophos endpoint to version FTS 2025.2.3.32.2-MR5 (This per our IT dept, I don't know exactly which products we're running). QuartusPro now runs OK, but we're still having an issue with some of the utilities such as quartus_sign.exe.  We still have an open ticket with Sophos.

For us it is currently resolved with a workaround of updating Sophos to 

• 2025.2.3.32.2-MR5 core
• 2025.2.3.9.3-MR5 intercept

and also adding exclusions to the Quartus bin64 executables folder. Specifically:

• Add a Process Exclusion
• Add a File/Folder Exclusion
• Add an Exploit Mitigation Exclusion for the process and path

The form of the exception entry is also sensitive, and works with (for example) 

D:\intelFPGA_pro\24.1\quartus\bin64\*.exe but not D:\intelFPGA_pro\24.1\quartus\bin64\* 

Sophos has not said whether the exceptions are permanent or whether they will work to resolve the underlying false detections related to Quartus.

Different engineers in our group have different versions of Quartus installed. One of them has also successfully tested Pro version 25.3 after explicit Sophos exclusions were added. We have not had any issues with Quartus Prime or Lite. I will update the solution post above if I find that additional steps were needed beyond what's listed there.  Note that the exclusion is drive specific - if one user has installed on C:\ and another on D:\ that requires two explicit exclusions.

Below is a part of our discussion with Sophos - adding exclusions seems to be their position on cases like this.

• Sophos continuously improves its detection capabilities to enhance protection against new and emerging threats. As part of these updates, detection logic may be strengthened or newly introduced. This can sometimes result in legitimate applications being flagged if their behavior matches known exploit techniques.
• Additionally, if the application (such as Altera Quartus Prime Pro) performs actions that resemble exploit techniques or if certain components of the application are considered vulnerable, Sophos may begin monitoring or blocking those behaviors.
• Some legitimate applications perform low-level operations (e.g., DLL loading behavior, memory manipulation, command execution, or dynamic code execution) that are similar to techniques used by malware.
• In such cases, Sophos detects the behavior as a potential exploit, which may use advanced system-level operations as part of its normal functionality, even if the application itself is trusted. When you add an exploit or process exclusion Sophos stops monitoring or blocking those specific behaviors for that application. This prevents the Sophos endpoint agent from triggering alerts or blocking execution.

Hi Kenny,

The administrator says there's nothing new in the workaround. He already did that two months ago (excluding the bin64 directory from Sophos scan).

Unfortunately, I can't run any tests with Sophos myself, so we'll have to play “Chinese whispers” here :)

Jens

Hi Jens​, 

I am Zi Ying and am currently assisting Kenny with this support ticket while he is out of the office.

Just checking in to see if there are any updates regarding the issue following Kenny's response on 28 Aug 2026.

Thank you! 

Regards, 
ZiYingE_Altera

Hi Kenny,

Yes, if Altera can't get anywhere with Sophos, you can close the case.

But I don't think our admin wants to do anything about it. Unfortunately.

Jens