The Sophos Community will be offline for scheduled maintenance this Saturday, May 27th, at 13:00 UTC for approximately 1 hour. Apologies for any inconvenience caused.
"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
Following an update the Sophos Anti-Virus service is unable to start. The following error is shown in the SAV.txt file when attempting to start the service:
[date] [time] Loading SAV Interface returned the error 0xa0040223: SAV Interface must be re-initialized - the detection engine has a version later than that that the running version of SAV Interface supports.
The event log will show the following error when attempting to start the Sophos Anti-Virus service:
Event ID 7024 The Sophos Anti-Virus service terminated with service-specific error %%-2147467259.
First seen in Sophos Anti-Virus for Windows 2000+
Cause The version of SAVI.DLL that is loaded by the Sophos Anti-Virus service is too old to be used with the detection engine. This will occur if two major updates are installed one after the other without performing the required reboots. Often seen on server that having been left running for a considerable amount of time, but can also occur in the event of an upgrade/downgrade/upgrade of Sophos Anti-Virus. This will cause multiple SAVI.DLL files to be created, the service will only load one of these files.
Reboot the computer to allow the upgraded files to be replaced. This will ensure that the Sophos Anti-Virus service is able to load the correct/latest version of SAVI and therefore be able to use the newest features of the detection engine.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.