Quartus did not start

Hi Kenny,

The administrator says there's nothing new in the workaround. He already did that two months ago (excluding the bin64 directory from Sophos scan).

Unfortunately, I can't run any tests with Sophos myself, so we'll have to play “Chinese whispers” here :)

Jens

Below is a part of our discussion with Sophos - adding exclusions seems to be their position on cases like this.

• Sophos continuously improves its detection capabilities to enhance protection against new and emerging threats. As part of these updates, detection logic may be strengthened or newly introduced. This can sometimes result in legitimate applications being flagged if their behavior matches known exploit techniques.
• Additionally, if the application (such as Altera Quartus Prime Pro) performs actions that resemble exploit techniques or if certain components of the application are considered vulnerable, Sophos may begin monitoring or blocking those behaviors.
• Some legitimate applications perform low-level operations (e.g., DLL loading behavior, memory manipulation, command execution, or dynamic code execution) that are similar to techniques used by malware.
• In such cases, Sophos detects the behavior as a potential exploit, which may use advanced system-level operations as part of its normal functionality, even if the application itself is trusted. When you add an exploit or process exclusion Sophos stops monitoring or blocking those specific behaviors for that application. This prevents the Sophos endpoint agent from triggering alerts or blocking execution.

Different engineers in our group have different versions of Quartus installed. One of them has also successfully tested Pro version 25.3 after explicit Sophos exclusions were added. We have not had any issues with Quartus Prime or Lite. I will update the solution post above if I find that additional steps were needed beyond what's listed there.  Note that the exclusion is drive specific - if one user has installed on C:\ and another on D:\ that requires two explicit exclusions.

For us it is currently resolved with a workaround of updating Sophos to 

• 2025.2.3.32.2-MR5 core
• 2025.2.3.9.3-MR5 intercept

and also adding exclusions to the Quartus bin64 executables folder. Specifically:

• Add a Process Exclusion
• Add a File/Folder Exclusion
• Add an Exploit Mitigation Exclusion for the process and path

The form of the exception entry is also sensitive, and works with (for example) 

D:\intelFPGA_pro\24.1\quartus\bin64\*.exe but not D:\intelFPGA_pro\24.1\quartus\bin64\* 

Sophos has not said whether the exceptions are permanent or whether they will work to resolve the underlying false detections related to Quartus.

Updated the Sophos endpoint to version FTS 2025.2.3.32.2-MR5 (This per our IT dept, I don't know exactly which products we're running). QuartusPro now runs OK, but we're still having an issue with some of the utilities such as quartus_sign.exe.  We still have an open ticket with Sophos.

I should also ask - is anyone is running CyberArk in addition to Sophos?

As of 5/7 no solution from Sophos.

Is anyone running Crowdstrike in addition to Sophos?

For us, the problem only affects Quartus (Prime) Pro and not Quartus Prime. Is that the same for everyone?

We are still working with Sophos but so far they have not found the cause in their logs or PML. Setting exceptions is also not working. Hopefully we'll find out something soon. I'll post here when we learn anything.

Hi KennyT,

I received you email and forwarded it to our IT department. 

I'll keep you posted.

Jens

Turning off Sophos allows me to run QuartusPro, same as others have noted.

However I still get 0xc0000142 DLL issues when trying to run a few  utilites: quartus_sign, quartus_worker, and quartus_encrypt. There may be others.

Running with something as simple as -h command line option fails.