You have received a firewall event (in Enterprise Console) or message (on the endpoint) for a hidden process 'SAVProxy.exe', launched by %ProgramFiles%\Sophos\AutoUpdate\ALMon.exe.
Known to apply to the following Sophos product(s) and version(s)
Sophos Client Firewall 2.5.0
Sophos Anti-Virus for Windows 2000+ 9.5.0
Enterprise Console 4.5.0
What To Do
Allow all the hidden processes launched by ALMon.exe to be launched and then restart the computer.
SAVProxy.exe is part of the new Sophos component responsible for Sophos Live Protection sample submission. This process is responsible for setting the proxy to be used for Live Protection sample submission, and that feature will not be enabled until the endpoint computer is restarted.