If you use Internet Information Services (IIS) 6.0, which is supplied with Windows 2003, only files with extensions registered in the IIS MIME types list will be served. To ensure that IIS serves Sophos files, add each extension used by those files to the list (alternatively use a wildcard '.*').
What to do
Find the top-level Sophos directory, open the properties pages and click the HTTP Headers tab. Then select MIME types and add the extensions, mapping them to the MIME type 'application/octet-stream'.