Sophos SysTray Icon saying Sophos is deactivated when in fact it's not

Sorry for getting back to you only now, I was away for a couple of days.

A happy new year to you by the way!

Actually, I have tried logging in as a different user two months ago, as (for other reasons than Sophos) I did a clean reinstall in November last year (which would have created a new user profile from scratch), and I had the problem before that reinstall and now I still have it.

Things which might be different on our computers which come to mind are:

- I use a German version of Windows 8.1

- Since I use the OEM version of Windows 8.1 which came with my computer, even a "clean" reinstall means installing Windows 8 first, then upgrading to Windows 8.1

- I use a Microsoft account to log in, though that can't be the problem, as before the reinstall I used a local account and had the same problem.

I tried restarting both

• Sophos Anti-Virus Service
• Sophos Autoupdate Service

and it didn't change anything about what the trayicon said. In fact, I tried restarting every service of Sophos I could find in the services.msc, nothing changed the systray icon, only restarting AlMon.exe does.

I did try what you suggested and had a look at Almon.exe with Process Explorer, the resulting files are attached. Upon comparing them with Notepad++ and the Compare Plugin, I found that the working version has three additional things running which I cannot find running in the missing version:

config.dll    Sophos AutoUpdate configuration manager    Sophos Limited    C:\Program Files (x86)\Sophos\AutoUpdate\config.dll

dllhost.exe        1.524 K    5.656 K    5340    COM Surrogate    Microsoft Corporation

audiodg.exe        6.008 K    8.988 K    7004    Windows Graphisolierung für Audiogeräte     Microsoft Corporation

Now, I can't even remotely figure out why the TrayIcon would have audiodg, maybe to alert me with a sound when a virus/malware is found? Or maybe Process Explorer just dumps all running things and not only for the selected process. :)

Anyway, the not working version of Almon.exe (i.e. the version claiming that Sophos is deactivated) has the three things just mentioned missing, but also a few additional things the working version does not have:

actxprxy.dll    ActiveX Interface Marshaling Library    Microsoft Corporation    C:\Windows\SysWOW64\actxprxy.dll

msxml6.dll    MSXML 6.0    Microsoft Corporation    C:\Windows\SysWOW64\msxml6.dll

msxml6r.dll    XML Resources    Microsoft Corporation    C:\Windows\SysWOW64\msxml6r.dll

Now, from my point of view, it seems that the config.dll somehow gets unloaded, I jut wonder how to find out how and why.

I had a look at the file in C:\Program Files (x86)\Sophos\AutoUpdate\config.dll, permissions seem to be fine (full control for SYSTEM and Administrators, read access for Users), the certificate is also valid.

Just on a side note, when looking at the permissions of various Sophos processes with Process Explorer, I often see unknown users in the ACLs (for example a user S-1-5-5-0-106062 for Almon.exe, or S-1-5-5-0-2738596 for SavService.exe), is that intentional or is there a problem with that? Although I couldn't figure out why there would be a problem, like I said, it's a clean reinstall, since November I have never added or removed users, I my computer is not jointly used...

Still puzzled by this. :)

Regards,

Peter

Sorry for getting back to you only now, I was away for a couple of days.

A happy new year to you by the way!

Actually, I have tried logging in as a different user two months ago, as (for other reasons than Sophos) I did a clean reinstall in November last year (which would have created a new user profile from scratch), and I had the problem before that reinstall and now I still have it.

Things which might be different on our computers which come to mind are:

- I use a German version of Windows 8.1

- Since I use the OEM version of Windows 8.1 which came with my computer, even a "clean" reinstall means installing Windows 8 first, then upgrading to Windows 8.1

- I use a Microsoft account to log in, though that can't be the problem, as before the reinstall I used a local account and had the same problem.

I tried restarting both

• Sophos Anti-Virus Service
• Sophos Autoupdate Service

and it didn't change anything about what the trayicon said. In fact, I tried restarting every service of Sophos I could find in the services.msc, nothing changed the systray icon, only restarting AlMon.exe does.

I did try what you suggested and had a look at Almon.exe with Process Explorer, the resulting files are attached. Upon comparing them with Notepad++ and the Compare Plugin, I found that the working version has three additional things running which I cannot find running in the missing version:

config.dll    Sophos AutoUpdate configuration manager    Sophos Limited    C:\Program Files (x86)\Sophos\AutoUpdate\config.dll

dllhost.exe        1.524 K    5.656 K    5340    COM Surrogate    Microsoft Corporation

audiodg.exe        6.008 K    8.988 K    7004    Windows Graphisolierung für Audiogeräte     Microsoft Corporation

Now, I can't even remotely figure out why the TrayIcon would have audiodg, maybe to alert me with a sound when a virus/malware is found? Or maybe Process Explorer just dumps all running things and not only for the selected process. :)

Anyway, the not working version of Almon.exe (i.e. the version claiming that Sophos is deactivated) has the three things just mentioned missing, but also a few additional things the working version does not have:

actxprxy.dll    ActiveX Interface Marshaling Library    Microsoft Corporation    C:\Windows\SysWOW64\actxprxy.dll

msxml6.dll    MSXML 6.0    Microsoft Corporation    C:\Windows\SysWOW64\msxml6.dll

msxml6r.dll    XML Resources    Microsoft Corporation    C:\Windows\SysWOW64\msxml6r.dll

Now, from my point of view, it seems that the config.dll somehow gets unloaded, I jut wonder how to find out how and why.

I had a look at the file in C:\Program Files (x86)\Sophos\AutoUpdate\config.dll, permissions seem to be fine (full control for SYSTEM and Administrators, read access for Users), the certificate is also valid.

Just on a side note, when looking at the permissions of various Sophos processes with Process Explorer, I often see unknown users in the ACLs (for example a user S-1-5-5-0-106062 for Almon.exe, or S-1-5-5-0-2738596 for SavService.exe), is that intentional or is there a problem with that? Although I couldn't figure out why there would be a problem, like I said, it's a clean reinstall, since November I have never added or removed users, I my computer is not jointly used...

Still puzzled by this. :)

Regards,

Peter