A balloon message appears after an update showing that On-access is disabled. After an update on-access appears as enabled and there are no warnings shown against the Sophos Shield.
Known to apply to the following Sophos product(s) and version(s)
Sophos Endpoint Security and Control
Sophos Anti-Virus for Windows 2000+ 9.5.5
This is by design and caused by the update process while on-access/SAV service is restarted. Sometimes the behaviour of balloon tips mean that the messages can remain on screen until there is some interaction with the session.
If Sophos on-access scanning is disabled permanently then a warning triangle is displayed in the notification area, this would be different to the above.
What to do
Refer to knowledgebase article 113287 for details of how to disable balloon tips.