First of all i'd point out sophos. it doesn't check the 8k write, it check the full iris.dat file if it's not excluded. Try to switchoff the AV