"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
After logging on the following error is shown on the endpoint:
Proxy Configuration has stopped working A problem caused the program to stop working correctly. Windows will close the program and notify you if a solution is available
The Windows application event log shows the following:
Event ID: 1000 Faulting application savproxy.exe, version 220.127.116.1130, faulting module ole32.dll, version 5.1.2600.3311, fault address 0x0002cdbd
Event ID: 1000 Faulting application name: savproxy.exe, version: 10.0.4.6991, time stamp: 0x4f96ba5a Faulting module name: NLAapi.dll, version: 6.1.7601.17514, time stamp: 0x4ce7b90f Exception code: 0xc0000005
First seen in Sophos Anti-Virus for Windows 2000+ 9.5.4
This can be resolved by re-registering the OLE32.dll as follows:
Citrix uses a number of API code hooks which can disrupt some applications, SavProxy.exe should be excluded from these hooks to avoid application errors.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.