Endpoint Security and Control reports a firewall event for SAVProxy.exe

  • Article ID: 111336
  • Updated: 14 Jul 2010

You have received a firewall event (in Enterprise Console) or message (on the endpoint) for a hidden process 'SAVProxy.exe', launched by %ProgramFiles%\Sophos\AutoUpdate\ALMon.exe.

Known to apply to the following Sophos product(s) and version(s)
Sophos Client Firewall 2.5.0
Sophos Anti-Virus for Windows 2000+ 9.5.0
Enterprise Console 4.5.0

What To Do

Allow all the hidden processes launched by ALMon.exe to be launched and then restart the computer.

SAVProxy.exe is part of the new Sophos component responsible for Sophos Live Protection sample submission. This process is responsible for setting the proxy to be used for Live Protection sample submission, and that feature will not be enabled until the endpoint computer is restarted.

If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent