Sophos

Online support

Product maintenance

Contact support

Support services

Sophos Anti-Virus for Windows 2000+: installing on computers running encryption software

Installing some types of encryption software can prevent the Sophos Anti-Virus on-access scanner from detecting viruses. This happens because data is passed to the Sophos on-access scanner before it is decrypted, and encrypted data cannot be accurately scanned.

The types of encryption software which could cause this problem are those which load as a filter driver. However, this type of software is not normally installed as standard on a Windows computer.

Before you carry out this procedure, run the Sophos test program savtst32.exe, to check whether virus detection is working properly.

What to do

Change the order in which the Sophos Anti-Virus on-access scanner and the encryption software load during the computer's startup sequence (the startup priority), so that data is decrypted before it is scanned for viruses.

  1. Read the warning about editing the registry.
  2. Edit the following registry keys:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
    \Services\SavOnaccessControl\Start

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
    \Services\SavOnaccessFilter\Start

    In both of these locations, set the DWORD values to 2 (the default is 1).
  3. Also, edit the registry key

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SAVService\DependsOnService

    and replace

    RPCSS

    with

    RPCSS
    SAVOnAccess Control
    SAVOnAccess Filter

    Separate each entry with a carriage return.

This change means that, when the computer start-up sequence runs, the Sophos on-access scanner loads after the encryption software.

If you need more information or guidance, then please contact technical support.