This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Error Message: Rootkit scan cancelled due to a corrupt disk

We are seeing the rootkit scan fail on multiple systems due to a "corrupt disk". Specifically the error is:

Code: a01e0004

Description: Rootkit scan cancelled due to a corrupt disk

Have checked systems experiencing this error and there is no problem with the disk (scans are negative). Any idea what corrupt disk this might refer to. Also interesting is clicking on the link back to sophos knowledgebase comes up with nothing. That is there is no entry for error code a01e0004.

We are running enterprise console 4.0.0.2362.

System experiencing the error is running Windows Vista service pack 2.

Anyone have ideas on what might be causing this?

Thanks in advance.

This thread was automatically locked due to age.

0 QC over 14 years ago

Hello,

according to support this is a known error and will be fixed in one of the next versions. It happens when a full scan is performed. I haven't checked whether the whole scan is aborted in this situation. Support suggested to turn off Scan for suspicious files (HIPS) if it's a scheduled scan

Question to Sophos: How will we be informed when such errors have been fixed? That is - you turn off some feature since it's causing problems but you'd turn it on again when the issue has been fixed. But how do you know it has?

Christian
:1524
Cancel
Vote Up 0 Vote Down

Cancel
0 sophos-icated over 14 years ago

QC,
Thanks for the info. You don't by chance have any similiar info on the following:
Code e03d0035 with description "The on-access drive failed to attach to \Device\ADVirtualDisk\Volume, because the I/O method is not supported

Sophos knowledgebase describes the alert as something that can just be ignored. Any ideas if this is also considered a none issue that might be resolved in the future?
:1546
Cancel
Vote Up 0 Vote Down

Cancel
0 Qubis over 14 years ago

Hi, it is well known issue with Adobe CS (CS4) Please see Adobe forum about this topic: http://forums.adobe.com/thread/314267 In SEC you can ignore this message and live with it, or uninstall Adobe CS if it is not needed on affected computer(s).
:1547
Cancel
Vote Up 0 Vote Down

Cancel
0 Kev_b22 over 14 years ago

This article answers your question. It will be fixed in the June release http://www.sophos.com/support/knowledgebase/article/110368.html
:2116
Cancel
Vote Up 0 Vote Down

Cancel
0 MALeonard over 14 years ago

The above article is for v7.x.x. I'm running v9...was getting the 'rootkit' error all the time- I think was fixed in v9.0.2 (or 3) ?
Now get a couple occasionally - they may be v7 clients that have not upgraded yet.
:2125
Cancel
Vote Up 0 Vote Down

Cancel
0 pirivan over 14 years ago

I just wanted to chime in as well and request a response from a Sophos mod to address this. We are seeing:
Code: a01e0004
Description: Rootkit scan cancelled due to a corrupt disk
On 3-4 machines in the console every morning (after they would have run the scheduled scan in the evening). The one common thread to these machines (they are both Vista and 7) is that they are all laptops.
We are running SAV 9.0.5.
As a previous poster mentioned, the link provided that lists that this issue will be "fixed" in the June update (released in May) is in application to SAV v7. Will an update to fix this issue also be pushed out for SAV v9?
:2326
Cancel
Vote Up 0 Vote Down

Cancel
0 pirivan over 14 years ago

Hi Sandy,
Thank you for the official response; we appreciate the update.
:2392
Cancel
Vote Up 0 Vote Down

Cancel
0 towe over 13 years ago

Hi,
Is this problem solved? i still have a couple of machines reporting this after a scheduled scan.......
OS: Vista
SP: 2
SAV version: 9.0.5 VDL4.54G
Regards,
Towe
:3737
Cancel
Vote Up 0 Vote Down

Cancel
0 Shai_Gelbaum over 13 years ago

Hi,
The problem was fixed in SAV version 7.6.20 and in 9.5. If you still experience the issue after upgrading let me know.
Shai Gelbaum
Product Manager
:3759
Cancel
Vote Up 0 Vote Down

Cancel
0 towe over 13 years ago

Thanks Shai,
I´ll keep an eye open for this issue after upgrading to verion 9.5.
Regards,
/Towe
:3769
Cancel
Vote Up 0 Vote Down

Cancel