Sophos EndUser Protection

[NickC]

Firstly sorry if this has been covered before.

So about a week ago I installed Sophos Endpoint Security and Control.  The username and password for both the credentials and the auto updating are correct as of today - Tuesday 29/03/2011.

Upon installing it I commenced a full computer scan with no problems and it revealed nothing (new laptop).  Now I have just got my wireless internet connected and all of a sudden the On-Access Scanning is Disabled.

The details are as follows:

Product Version -- 9.5

Operating System -- Windows 7 64 Bit

Update Version -- Unknown (presumably the latest as it allows updating)

I do not know what to do, any help would be greatly appreciated.  If anyone needs any more details please ask.

Kind Regards

[NickC]

Just a few extra details, don't know if they will help.

The blue Sophos shield has a small red X on it, and when I scroll over it it says the following;

Sophos Protection

Anti-virus and HIPS: service failure

Last checked for updates: 29/03/11

This is a screen shot of the Sophos Endpoint Security and Control window:

[QC]

Hello NickC,

please open the GUI. Top left you see the Status pane, from what you said the first line is On-access scanning: Disabled. In the same pane there's also Last updated - this should be fairly recent. The product details can be accessed via View product information under Help and information. Very likely the Last updated is different from the one in Status: The latter is the time of the last check, the former of the last change (i.e. when "something" has been downloaded). You should see at least the General, Anti-virus and HIPS, Auto update and System sections.

Go back to the Home view and View updating log - are there any erros like Failed to install ...?

Also from the Home view - can you access Configure anti-virus and HIPS under Anti-virus and HIPS?

BTW: Did you contact your site's IT-support?

Christian

[QC]

Probably the Sophos Anti-Virus service fails to start. Try to start it (using Computer->Manage or run services.msc) and if this fails check the event logs for the reason (eventvwr.msc).

Christian

[NickC]

Christian,

Thanks for replying.

I had a look at the Status and Last Updated correlates with the Last checked for updates time.

I had a look at the log and to be perfectly honest I am not sure what I am exactly looking for.   I see some failed updates but that is expected as I didn't connect the internet til today at about 18:00 Hours.

I just looked under Product Information as you said and I found something weird.  Under Anti-virus and HIPS>Software it says None?

Maybe this has something to do with it, or it could just be a result of another problem, as I said it worked when I first installed it, as I immediately ran a full system scan.

Kind Regards

Nick

[NickC]

---

QC wrote:

Probably the Sophos Anti-Virus service fails to start. Try to start it (using Computer->Manage or run services.msc) and if this fails check the event logs for the reason (eventvwr.msc).

Christian

---

Christian

OMG!

You will never believe it, I figured out why it was not working.  I tried to start Sophos manually through Services and it failed naturally.  I then went to check the Event Logger and realised it was disabled.  As soon as I enabled it Sophos started without any issues.

I had previously disabled Windows Event Logger due to it interfering with another program and it seems that Sophos cannot operate correctly without the eventvwr.msc activated.

Geez that is a huge relief.

Thank you so much for you help if you hadn't suggested looking at the log I may never have found the solution.

Hopefully if anyone else encounters this issue they will come across this extremely simple solution.

Many many thanks

Nick

[jrd]

NickC

Hi, I am getting exactly the same error shown in the screen shot above. Could you please explain how did you enable your event log?

[Praveen_P]

Enable event log service ::: Go to Start -> Run -> Services.msc -> enable/start "Windows Event Log service"