The Sophos Community will be offline for scheduled maintenance this Saturday, May 27th, at 13:00 UTC for approximately 1 hour. Apologies for any inconvenience caused.
"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
The following error is shown in the SAV.txt log file:
Scanning "<filePathHere." returned SAV Interface error 0xa0040202: Scan failed.
In the Windows System Event log you see:
Event ID 47 File systems using direct I/O are not supported. Source: SAVOnAccess
The computer may also hang (lock up) during general use or a scheduled scan is running.
First seen in Sophos Anti-Virus for Windows 2000+
This can be caused by the on-access scanner trying to scan file systems other than NTFS and FAT. It is also seen when data is on a virtual file store, which in some cases is presented to users through SQL and a front end application.
Using the SAV.txt log file, create a set of exclusions for the paths mentioned in the log under Exclusions in your Anti-Virus and HIPS policy. Push this modified policy out to all clients that are affected.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.