Sophos Anti-Virus service will not start

Oh I couldn't stand all that coddling, I like to run my IT fast and loose :D If there isn't an element of risk they could employ just anybody to be a sysadmin, knowing they can't kill anything.

Where's the fun in that? ;)

No beer tonight but wassailing on sunday :-D (sometimes it's good to live in the countryside)

Did you ever determine a fix for this StevieB (or anyone else for that matter)?  I also have an XP SP3 client machine whose Sophos service I am unable to start manually and in the event logs I see:

Exception caught in CInfrastructureModule : : PreMessageLoop

I've ran the uninstall script and reinstalled the client software via the console a couple of times and that seems to work without any issues.  It appears to run for a small period of time normally and then the service just quits and can't be restarted and I see the above errors.  As with others in the thread I am also running SAV v9 console v4.

Just as an update to this issue, on the Windows XP SP3 PC that this is affecting I have confirmed the following behavior:

1. Uninstall SAV v9 from add/remove
    a. Main SAV component first (said no to rebooting immediately)
    b. Sophos AutoUpdate
      i. You get the warning ‘‘‘‘Warning 25010.An error occurred while running the custom action ‘‘‘‘NoUpdateInProgress’’’’.  Contact your support personnnel’’’’
      ii. Click OK twice to this and it continues
      iii. Runtime error pops up ‘‘‘‘RunTime Error!  Program: C:\Program Files\Sophos\AutoUpdate\ALsvc.exe This application has requested the Runtime to terminate it in an unusual way.  Please contact the applications support team for more information.’’’’
      iv.  Uninstall of Autoupdate finishes despite the errors/warnings
    c. Sophos Remote Management System, uninstall works fine
2. Reboot
3. Delete object from the SAV console
4. Reinstall SAV via an automatic AD sync works just fine, then after rebooting (to complete the installation) SAV appears to work fine
5. No SAV service failures with the client running overnight
6. After a second reboot you get the errors in the event log and cannot start the SAV service and get the below error:
    a. ‘‘‘‘The Sophos Anti-Virus service terminated with the following error: Unspecified error’’’’
7. In the application event log you see
    a. Exception caught in CInfrastructureModule::PreMessageLoop.
8. In the system event log
    a. ‘‘‘‘Could not start the Sophos Anti-Virus service on Local Computer.  Error 0x800004005: Unspecified error’’’’

So, it appears to be after the SECOND reboot is when it really starts malfunctioning.

I worked with Sophos support and was able to resolve this issue.  As it turns out this was related to a recent Sophos GPO we had rolled out.  The GPO was intended to ONLY allow Domain Administrators to stop Sophos related services.  While it worked/works fine on Vista and Windows 7 machines it was causing the above issue on Windows XP.  We've removed that GPO and will either not deploy it or work on testing one that works as intended.

Hi guys,

soz it's taken so long (busy sysadmin) yep the script fixed the problem. I edited it to include all the manual steps sophos put into the email they sent me the script with.

The process was a follows...

• Uninstall (control panel -> add remove software) all sophos installed apps.
• Run the script
• Reboot
• Run the script
• Reboot
• Explore c:\documents and settings\<sophos username>\local settings\temp and delete everything
• Reboot
• On the enterprise console run "protect computers" and push out the new sophos (while still logged onto the client pc)
• Watch the install on the client pc (right click the shield, "view update status"),...when it has finished
• Reboot
• Shut down and return to the user.

PITA but it works... Hope this helps someone else.

Hi Guys

We have our own scripts that we wrote for the installation of Sophos on all our different branches and I had this issue in the one branch only, and also on certain machines(not all of them) And obviously only the machine that had failed installations before etc as the ones that were successfully installed never had this issue.

It seems like you cannot start the Sophos Anti-Virus Service on the computers affected.

Note on script: It is basically bypassing the manual install using the Enterprise Console, by automatically entering the Username and Password as well as Installation location(aka the branch's server) and also deleting registry keys for any machines where people loaded AVG before(as Sophos seems to struggle removing AVG registry keys and then fails with installations...)

What I did to fix it:

I had to make another copy of the Sophos Install source location(on the server from another distribution server that installs to clients without any issues.) and then after the copying is complete, get the users to run the script on all the machines that were affected... (And obviously you'll know which since they will not have Sophos installed....)

This worked for me, will monitor and let you know if it doesn't work tomorrow or if something else breaks in the interim...

I tested one machine manually from the Console and it worked fine... :smileyvery-happy:

Good luck guys!!

We are having same problem,

Where I can get the script?

Thanks

Saugata

For me the service had an invalid password for the Local System account.  So, instead of using the defined local system account, I selected the one where I didn't have to enter a password.  This is found on the properties of the service, on the logon tab.

Whoops.  The next update broke it again.  Nevermind.