Sophos Anti-Virus for Mac Home Edition

[floridabrits]

I see a number of threads here with folks having stalling systems, but I have a situation where my Macbook Air completely freezes up (usually when Time Machine backup starts, or that's what I have observed when I wake the system up... the system wakes up, then freezes as Time Machine backup starts).

I logged a case with Apple and since they told me to remove Sophos Antivirus and since then my system has completely stabilized and I've not had a freeze in over a week (prior to uninstallation of Sophos my system was freezing up between 1 and 5 times a day).

Any ideas 'why' this is happening and if Sophos are aware of this and looking to patch/fix it?  Has anyone else experienced this issue and is it possible to run Sophos on Macbook Air/Lion or is there a compatibility issue?

Many thanks for any help/pointers!

[floridabrits]

Many thanks for any help/pointers!

[floridabrits]

As an update. I reinstalled Sophos yesterday and unchecked the boxes for scanning inside compressed files and archives. This morning when I woke up, the system was frozen again. I have had to uninstall Sophos until I can find out what the problem is.... is anyone from Sophos watching these forums and can you comment please. I would like to know why this system freezes and my Mac mini does not (by the way I have a friend in the UK who has Sophos installed on an iMac and he has the same problem... he has uninstalled Sophos to see if that stabilizes his system too).... So.... for the time being this definitely affects the Macbook Air and the the iMac, but not my Mac mini (I have one old version and one new one and neither are affected). Many thanks for any insight into this...

[Agile]

I don't think it's a hardware-specific issue, as the software is tested on iMacs and MBAirs as well as Minis.

One question for you: did you leave the Sophos Anti-Virus application running, or did you quit it and leave it only running in the background?

[floridabrits]

Andrew,

Thanks for your response...   It was just left running in the background...

Would love to solve this conundrum so I can put Sophos back on the Macbook Air...

Thanks for any further help or guidance.

[Agile]

You wouldn't happen to have disabled virtual memory would you?  This is exactly what I would expect to happen with virtual memory disabled.

If you haven't, what happens if you add /private/var/vm/ to the exclusion list?

(It just so happens that another user was having issues with VM being blocked by detections in this build)

You may also want to exclude your TimeMachine backup drive/folder to see if that helps.  I'm figuring that if you keep on-access scanning enabled and have scanned your backups already, it's unlikely they'll become infected.

[floridabrits]

You wouldn't happen to have disabled virtual memory would you?  This is exactly what I would expect to happen with virtual memory disabled.

----- How would I know/how do I check this?   I haven't done anything specifically to change anything with the memory, so 'probably' not...

If you haven't, what happens if you add /private/var/vm/ to the exclusion list?

---- I could reinstall and try this for sure.

You may also want to exclude your TimeMachine backup drive/folder to see if that helps.  I'm figuring that if you keep on-access scanning enabled and have scanned your backups already, it's unlikely they'll become infected.

---- Again, I could reinstall and try this, but my Mac mini is running Sophos straight 'out of the box' with no exclusions at all (including my Time Machine backup drive) and it doesn't cause any issues, so wondering why the Macbook Air would be different?

Thanks...

Once I hear back from you I can reinstall and try again with these changes...  I have just uninstalled using the 'Sophos Uninstall' in Applications, so are there any other files/folders I should delete to ensure a 'clean/fresh' install?

Thanks again...

[Agile]

If you haven't intentionally disabled Virtual Memory, then this isn't an issue.

Excluding the two paths would be great for narrowing down where the actual issue is/isn't -- if you still get lockups, you'll know that the issue isn't with virtual memory management or actual backups.  However, there are really only three major things that happen when a TM backup kciks off:

1) rsync starts checking all the files on your drive to see if they've changed

2) TM reserves a bunch of memory

3) TM sometimes mounts a disk image to write the backup to (this almost always happens if you're doing a networked backup)

Since the On Access scanner, when enabled, scans files when they are accessed by the OS, all these files have the potential to be scanned.  Do you have any difference in setup between your Air and your Mini, other than that your Air is using an SSD drive internally?  For instance, is the Mini connected to your backup drive physically (either via USB or Ethernet) and the Air connects via Wifi?

[floridabrits]

Andrew,

That's what's driving me crazy ;-)   There isn't really any difference other than the hardware... they have the same software installed and the Time Machine backups are both local to a 1TB USB Western Digital hard drive.

Anything you think I can try to narrow the problem down further?

Many thanks.

[Agile]

How much physical memory is installed on each device?

[floridabrits]

There is 4GB on the Air (almost never use it all as it's mainly used for mail and internet only).

There is 8GB on the Mac mini; almost never use it all either, but occasionally I run a Windows VM that starts to use up quite a bit, hence why I have 8GB installed.

Hope this helps?