Unable to start Sophos Anti-Virus service and the on-access scanning is disabled

Hello knotslanding,

the symptoms (1.,2.,5.) are the result of SavService failing to start. Error 0x80004005 could be a permissions issue (please see here for a possible scenario). I'd suggest you give Process Monitor a try.

Christian

Hello,

I want to thank you for your suggested solution.  However, I am not completely clear on what I should do or the steps to follow.  Thanks in advance.

If I understand you correctly, I need to check the permissions for the file SavService.exe file located in the folder C:\Program Files\Sophos\Sophos Anti-Virus. Please note that I am using Windows XP.

To do this, I right clicked the file and selected properties from the popup context menu.   Then I selected the Security Tab that lists the users and permissions.

What should the correct permissions be? I don’’’’t remember changing the permissions for this file. At the folder level, the possible permission choices are Full Control, Modify, Read & Execute, List Folder Contents, Read, and Write.   I am guessing it should probably be Read & Execute to prevent it from being deleted or changed but I am not sure.

See the attached jpg pictures of what I am seeing for the SavService.exe properties. It appears there are more than one user on my computer but I am not sure which one I should use.  (I basically log onto my computer (not on a domain).)

Once the file permissions are set correctly, then what is the next step to determine if I have any bad files like the FakeAV file you had.  I just need to be able to start the Sophos Anti-Virus Service in order to allow me to run a scan. It is presently grayed out and disabled. See my earlier message for more details.  Thanks.

I suspect, but I could be completely wrong, that I have a virus or some malware or spyware on my system. I just don't know for sure.  But, the last time I was able to successfully run a virus scan was at the end of January.  The good news was that Sophos found no problems at that time. But now, I can't start the Sophos Anti-Virus service in order to run a scan.  So at least until the end of January no problems were found.

I also tried the solution as suggested by another user: If you open up task manager and kill the Almon.exe process and then re-launch it by running:

\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe

or

\Program Files\Sophos\AutoUpdate\ALMon.exe

This did not resolve the problem and the Sophos Anti-Virus Service can't be started and the options in the Sophos Endpoint security and Control are still disabled.

Continuing with your suggestion, here are some follow-up questions:

1. What drivers should I check and how do I go about doing this?  I am kind of weary of deleting or messing things up.
2. How do you determine what or if any driver is causing the problem? 
3. And what tool did you use to identify the bad driver or file?
4. And how do you know if a file is truly bad? Possibly I can use the same steps you followed to determine my problem.  I am just not clear on the steps you did. 
5. How do you disable a driver or does that mean you just delete the file?
6. How do you determine if a hidden component is registered as a service like the FakeAV file you refer to?

Again, sorry but I seem to be lost and not clear on the steps you did.

In any case, can you provide additional steps or instructions on what I should do or what the exact steps you did in order to resolve the problem? And what permissions and for what users should I set. To be safe, I could (as a guess) just set the permissions for all the listed users in the jpg picture as I am not completely sure.  Any help is most appreciated.  Thanks so much for your time and I appreciate it.

Hello knotslanding,

the permissions look correct and whatever prevents SavService from starting successfully is probably not malware. Might indeed be that CCleaner was a little bit overeager. If you're not familiar with Process Monitor (even if you are there's still the challenge to identify the cause and correct it) a reinstall is the better option. Make sure there's no update in progress or scheduled for the next minutes and uninstall just the A-V component. AutoUpdate should attempt to reinstall with the next update.

Christian

Hello,

I am writing as a follow-up.  This morning February 26 after turning on my computer, the Sophos Anti-Virus service started successfully and when I opened the Sophos Endpoint Security and Control, the manual scan was not disabled.  I also no longer see the red cross on the Sophos icon in my system tray.  I am not sure how my problem resolved itself but it did and I am quite surprised.  I can't tell you how the problem resolved itself but it took about a month for this to be resolved and I did not have to reinstall Sophos which was my last resort.  I am hoping the problem does not return. Maybe there was a problem and possibly a Sohpos update fixed the problem. I am not sure and this is just a guess.  Anyway, thanks so much for the advice. 

By the way, I did not change permissions on the savService.exe file.  The only thing I did was run a disk cleanup to empty out the recycle bin and to clean up and a scan disk to check for disk errors (none were found).  (I still need to defragment my disk drive and do Windows Update though which may also help.)   I still believe I have malware or possibly a virus but I am not sure.  From time to time, my computer will just restart itself for no reason i.e. while streaming radio or browsing the internet.  And a few times, I have seen the blue screen of death but not since last month.  I am going to try to run a manual scan later today just to make sure, but the last time I ran a scan nothing was found at the end of January.  Sohpos is great program.

Thanks so much again.  I can now close this issue unless the problem returns.

Hello knotslanding,

I am not sure how my problem resolved itself [...] but it took about a month

with the release of VDL 4.98 a so-called Major Install was performed, likely it corrected whatever has been messed up. 

From time to time, my computer will just restart itself for no reason

Not necessarily because of malware. You are running XP and I guess the machine is not the latest and greatest. It could be a lot of things, including the hardware. Anyway, if you have an as yet undetected nasty something still hiding somewhere you'll likely not find it with a regular scan from Windows. There's a tool for scanning your computer while Windows is not active: Sophos Bootable Anti-Virus. If you choose to run it do a detect only scan first. If it does detect something please follow up here before taking further action.

Christian