This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Error Code a049001e

I have several machines that on 8/4/20 started showing error code a049001e on the Sophos Enterprise Console with the following description.

Event Decode Unavailable (Event Number: "-1605828578" Message Code: "SAVXP.2689138718" Inserts: "C:\Windows\system32\DisplaySwitch.exe", "NT AUTHORITY\SYSTEM", "", "", "").

After running all Windows updates on one particular machine that included the Feature update to Windows 10, version 2004 I'm now receiving the same error code a049001 but the description is now a little different.

Event Decode Unavailable (Event Number: "-1605828578" Message Code: "SAVXP.2689138718" Inserts: "C:\WINDOWS\system32\sethc.exe", "NT AUTHORITY\SYSTEM", "", "", "")

This error is on most if not all Windows pro PC'c. Anyone have an idea on what might be causing this error and a possible fix?

Thank you for any information!!

This thread was automatically locked due to age.

Parents

0 jak over 4 years ago

Is there a message in \ProgramData\Sophos\Sophos Anti-Virus\logs\SAV.txt at the same time?

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 Michael Sanders over 4 years ago in reply to jak

I don't see that there is. I do have several "Deadlock detected while asynchronously scanning file C:\Windows\System32\", errors with different file names.
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 4 years ago in reply to Michael Sanders

I suspect that might be the message with no server side decode. It seems a new message, not one I've seen before.

Maybe take a quick look at:

https://community.sophos.com/products/endpoint-security-control/f/sophos-endpoint-software/3934/event-decode-unavailable-event-number--2147024891-message-code-savxp-2147942404

I suspect that updating the SEC version to the latest may solve it. There is a chance that this is a new message that doesn't even exist in the latest server component, you could try taking the DLL from the client to the server as mentioned, just to see if the message then resolved correctly.

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 Soazig RENAULT over 4 years ago in reply to jak

Hi,

I have the same kind of error message on my console. It concerns only Windows 2019 servers physical or virtualized (on vmware or hyper-v)

The problem started when sophos was updated to version 10.8.9 VE3.79.0.

Our console is already updated to version 5.5.2.

I'll open a case with the support but if anyone has any information about that I'll take it

Regards,

SRe
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Soazig RENAULT over 4 years ago in reply to jak

Hi,

I have the same kind of error message on my console. It concerns only Windows 2019 servers physical or virtualized (on vmware or hyper-v)

The problem started when sophos was updated to version 10.8.9 VE3.79.0.

Our console is already updated to version 5.5.2.

I'll open a case with the support but if anyone has any information about that I'll take it

Regards,

SRe
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 jak over 4 years ago in reply to Soazig RENAULT

I guess this post is most relevant:

https://community.sophos.com/products/endpoint-security-control/f/sophos-enterprise-console/122257/deadlock-detected-scanning
Cancel
Vote Up 0 Vote Down

Cancel