Sophos Anti-Virus service will not start

Question

Hi,

I cannot start the Sophos Anti-Virus service on my laptop, message below

Am using Windows XP, and have tried opening from the shortcuts and also manually starting the service in services panel.

Any advice?

'Could not start the Sophos Anti-Virus service on the Local Computer.

Error 0x80004005: Unspecified Error'

This thread was automatically locked due to age.

jak · Accepted Answer

Hi,

Here are a few things to try that have fixed this for me in the past on a few machines I have seen this problem.

Note: On any machine running an OS later than Windows 2000, the SAV Service should always run as "Local Service". On 2000 it runs as "SYSTEM", so on all other platforms it should run as "Local Service".

Note: I have used the path \Programdata\ in the following tests, if you are running on 2000, 2003 or XP, please change this to be:
"\documents and settings\all users\application data\"

in the case of SAV files and
"\program files\sophos\" or "\program files(x86)\sophos\"

in the case of AutoUpdate config files.

Test 1

1. Stop the SAV Service (just a joke!).

2. Copy the file:

"\ProgramData\Sophos\AutoUpdate\Cache\savxp\CommonAppData\Sophos\Sophos Anti-Virus\Config\factory.xml"

over the top of:

"\ProgramData\Sophos\Sophos Anti-Virus\Config\factory.xml"

essentially replacing it. I'll assume the downloaded file by AutoUpdate is correct.

3. Attempt to start the SAV service.

Test 2

1. Stop the SAV Service (never gets old!).

2. Delete the file:

"\ProgramData\Sophos\AutoUpdate\data\status\status.xml"

3. Initiate an Update.

This will cause a "minor" install of SAV. It will also reinstall the other software components.

Note: To just reinstall SAV you can edit the file status.xml (suggest Notepad) and delete the InstalledVersion section under the SAVXP section. E.g. Remove the following section (InstalledVersion tags included):

<InstalledVersion>
                    <ProductID>
                        <rigidName>{E17FE03B-0501-4aaa-BC69-0129D965F311}</rigidName>
                        <shortFriendlyName>SAVXP</shortFriendlyName>
                    </ProductID>
                    <majorVersion>510</majorVersion>
                    <IsAvailableFromSophos>1</IsAvailableFromSophos>
                    <IsPMSpamRules>0</IsPMSpamRules>
                    <minorVersion>510.39</minorVersion>
                    <fileSetChecksum>4f66a9450d724c3d826bbfb3f141fc0f</fileSetChecksum>
                    <sourceUpdateMechanism>SDDS</sourceUpdateMechanism>
                </InstalledVersion>

Leaving just the <DownloadedVersion> section for the SAV package and kick off an update. This file is what AutoUpdate uses to check what is downloaded is the the same as what is installed for all packages it maintains. By deleting the installed section it will assume the component is not installed and install it.

Test 3

1. Stop the SAV Service (It got old!).

2. Delete the file:

"\Program Files (x86)\Sophos\Sophos Anti-Virus\savsync.upd"

or
""\Program Files\Sophos\Sophos Anti-Virus\savsync.upd"

3. Perform the same steps as in Test 2 to re-initiate an update.

This should perform a full install, and generate a full MSI log in \windows\temp\. If this fails, the generated MSI log and associated Custom Actions log should have the answers.

Please reply back with which helped, I'd be interested. :)

Regards,

Jak