The Sophos Community will be offline for scheduled maintenance this Saturday, May 27th, at 13:00 UTC for approximately 1 hour. Apologies for any inconvenience caused.
"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
The following issues occur when Sophos Endpoint Security and Control is either installed with short name support disabled or has the short name removed from the path to the Sophos folder:
First seen in Sophos Endpoint Security and Control
Windows uses 'spaces' as a delimiter in the following registry key, this means that DLL files and it's corresponding path must have a short name.
32-bit and 64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
Example value: C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL
See Microsoft KBA Q197571 for details on the restriction imposed on the use of spaces in this registry value.
Environments where the short name for the Sophos Anti-Virus path has been removed (Either in part or entirely) are not supported. Perform these checks to ensure your environment is supported.
Open a command prompt window, execute the following command:
fsutil behavior query disable8dot3
If the returned value is the following, short name creation has been disabled:
NtfsDisable8dot3NameCreation = 1
See this Microsoft article on how to enable short name support.
Open a command prompt window, execute the following commands:
dir /x \
DD/MM/YYYY HH:MM <DIR> PROGRA~1 Program Files
dir /x "\Program Files\Sophos"
dir /x "\Program Files (x86)\Sophos"
DD/MM/YYYY HH:MM <DIR> SOPHOS~1 Sophos Anti-Virus
The short name should be present in the 4th column (just before the long name).
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.