Sophos Anti-Virus service will not start

Hi,

which version? Did it ever work and was it a fresh install or an upgrade?

Unspecified Error is - as you may have expected - not very specific  and we'd need more details. So no advice yet (but yes, I once had one of these)

Christian

Yes  it has been running happily for a while now, no install and no upgrade.

When I look in the eventlog viewer I can see three errors relating to this start command

1.

E_FAILURE.

Cmanager::BeginProcessing in the ComponentManager component encoutnered a catastrophic error that it could not recover from

2.

Error when calling BeginProcessing on ComponentManager

3.

Exception caught in CInfrastructureModule::PreMessageLoop.

not sure why it put a smiley face in there, was supposed to be another

:

?

I'm getting exactly the same error. It's only affecting 3 pc's (1 laptop, 2 desktops) out of the entire estate.

Ive tried enforcing policies, reprotecting, uninstalling and reinstalling, manually starting the service etc. all to no avail.

Updates are happening, the dats are up to date.

Sophos Agent, Sophos Anti-Virus status reporter, Sophos AutoUpdate Service and Sophos Message Router are all running ok but the Sophos Anti-Virus service will not start.

My event log is littered with the following

Event Type: Error
Event Source: Sophos Anti-Virus
Event Category: None
Event ID: 6
Date:  14/01/2010
Time:  14:21:03
User:  N/A
Computer: XXXXXXXXX
Description:
E_FAILURE.
CManager::BeginProcessing in the ComponentManager component encountered a catastrophic error that it could not recover from.



Event Type: Error
Event Source: Sophos Anti-Virus
Event Category: None
Event ID: 19
Date:  14/01/2010
Time:  14:21:03
User:  N/A
Computer: XXXXXXXXX
Description:
Error when calling BeginProcessing on ComponentManager.



Event Type: Error
Event Source: Sophos Anti-Virus
Event Category: None
Event ID: 0
Date:  14/01/2010
Time:  14:21:03
User:  N/A
Computer: XXXXXXXXX
Description:
Exception caught in CInfrastructureModule::PreMessageLoop

And my System event log has the following

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date:  14/01/2010
Time:  14:20:28
User:  NT AUTHORITY\SYSTEM
Computer: XXXXXXXXX
Description:
The server {D2B7A809-15DC-40B4-A1E1-C61EA97191DB} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date:  14/01/2010
Time:  14:20:01
User:  N/A
Computer: XXXXXXXXX
Description:
The Sophos Anti-Virus service terminated with the following error: 
Unspecified error

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The CLSID {D2B7A809-15DC-40B4-A1E1-C61EA97191DB} is listed as "Infrastructure.ComponentManager"

Seems to happen now and then :smileyhappy:

Wanted to know what a well known search engine digs up for {D2B7A809-15DC-40B4-A1E1-C61EA97191DB}

And ... looking for ComponentManager I found this (just the first example, this script is all over the internet. Seems like half the planet thinks that uninstalling Sophos is no mean feat).

Christian

Probably this is something for which you should run the Sophos Diagnostic Utility and open a case with Support, as the reasons for the service failing to start can be quite varied.

However, you might check for a file:

C:\Documents and Settings\LocalService\Local Settings\Temp\Sophos Anti-Virus startup log.txt

which may reveal some additional information not present in the event log.

If you do open a case with Support, it would probably be helpful to also capture a Process Monitor log, in addition to the SDU output.

Kindest regards,

Tyler

I raised a call with Sophos yesterday, they sent me the same script that QC pointed me at. I ran it and now I can't protect the PC at all. 

Thanks for the link to the SDU I will run that on Monday (before the user gets in) and go around cleaning up the mess that the uninstall script has obviously left. Grr

---

StevieB wrote:

I raised a call with Sophos yesterday, they sent me the same script that QC pointed me at. I ran it and now I can't protect the PC at all. 

---

Don't sue me - I did I no way suggest you should use it :smileywink:

Seriously - I had forgotten this script although I did use (an older version of) it a long time ago. But can't say whether successfully or not.

I curious: Can't protect - using Protect Computers? And how does it fail?

BTW: If you do not want to pay the PC a visit - there's a not too complicated way to run SDU "from remote" (if you have administrative access to the PC over the net of course)

Christian

My fault entirely, the script is not for v9, I'm a muppet and ran it anyway. The email they sent me had additional instructions for v9 but I didn't notice and never ran them. So I have "sort of" uninstalled the AV but not completely. No surprise the console barfs when trying to reprotect.

Bad Steve, Bad Steve. No beer for me tonight :-(

Steve, wouldn't suggest it.

Is it your fault at all? The have no version check in the script - bad. And they should have first sent you the instructions without the script. And then they should have asked you, did you actually read the instructions?, before sending it. Right? Sophos protect your customers from themselvers! :smileyhappy:

Christian