Sophos Anti-Virus for Mac Home Edition

[AMC3]

Sophos noitfied me today that a piece of malware <Mal/Iframe-W> had arrived as an attachment to an email. However, when I opened the Quarantine Manager to manaually delete it, I could not get the QM to unlock. When I click on the lock icon, it just blinks and does not "open". Any suggestions?  

Sophos AV Ver. 8.0.6

[timdwyer]

I have the same problem

Version 8.0.6C

OS X 10.8 (12A269)

[timdwyer]

Now appears to be working fine (previously not)

8.0.6C

Mountain Lion

[chernobog]

Same problem here.  Are we all on Mountain Lion?  That's when the problem started for me.

[AMC3]

As indicated in my original post on this topic, I am on Lion (10.7.4).

[AMC3]

This issue is occurring on all 3 of the laptops in our home. All are running 10.7.4 (Lion).

[Agile]

Is there any non-standard software you've installed on all 3 laptops that operates at the system level (other than Sophos)?

Is there anything in the System log or Sophos log in console.app surrounding the time you clicked the lock?

[AMC3]

Andrew, what do you mean by "non-standard" software? That's a pretty broad term.

And... I glanced at my System log but am not sure what to look for. While the log was visible, I clicked on the lock in the Quarantine Mgr. Here's what shows up. Does any of it suggest anything useful?

System Log:

Aug 11 00:07:55 Mac-MBPro com.apple.launchd.peruser.501[490] (com.sophos.uiserver[45465]): Exited: Killed: 9
Aug 11 01:00:33 Mac-MBPro SophosAntiVirus[80]: reloading scheduled scans...
Aug 11 03:35:02 Mac-MBPro SophosAntiVirus[80]: reloading scheduled scans...
Aug 11 06:32:51 Mac-MBPro SophosAntiVirus[80]: reloading scheduled scans...
Aug 11 07:37:42 Mac-MBPro com.apple.launchd.peruser.501[490] (com.sophos.uiserver[48650]): Exited: Killed: 9
Aug 11 11:39:37 Mac-MBPro com.apple.launchd.peruser.501[490] (com.sophos.uiserver[49755]): Exited: Killed: 9
Aug 11 12:49:16 Mac-MBPro SophosAVAgent[51402]: Live protection is Enabled
Aug 11 12:49:16 Mac-MBPro com.sophos.notification[80]: 2012-08-11 12:49:16.745 SophosAVAgent[51402:3403] Live protection is Enabled
Aug 11 12:49:16 Mac-MBPro SophosAVAgent[51402]: Live protection is Enabled
Aug 11 12:49:16 Mac-MBPro com.sophos.notification[80]: 2012-08-11 12:49:16.783 SophosAVAgent[51402:3403] Live protection is Enabled
Aug 11 12:49:40 Mac-MBPro SophosAVAgent[51402]: CFPropertyListCreateFromXMLData(): Old-style plist parser: missing semicolon in dictionary.
Aug 11 12:49:40 Mac-MBPro com.sophos.notification[80]: 2012-08-11 12:49:40.715 SophosAVAgent[51402:3403] CFPropertyListCreateFromXMLData(): Old-style plist parser: missing semicolon in dictionary.

[Agile]

Ah; this is indeed useful:

Aug 11 12:49:40 Mac-MBPro SophosAVAgent[51402]: CFPropertyListCreateFromXMLData(): Old-style plist parser: missing semicolon in dictionary.
Aug 11 12:49:40 Mac-MBPro com.sophos.notification[80]: 2012-08-11 12:49:40.715 SophosAVAgent[51402:3403] CFPropertyListCreateFromXMLData(): Old-style plist parser: missing semicolon in dictionary.

 

This tells us that when you clicked the lock, it attempted to access a plist (preferences) file, and failed because the file is corrupt.  This would also explain why some people are seeing this lock stuck in the unlocked state.

 

I'd suggest running the following commands from Terminal.app (you'll need to run from an administrator account):

sudo plutil –s ~/Library/Preferences/*.plist

sudo plutil –s /Library/Preferences/*.plist

sudo plutil –s /Library/Sophos\ Anti-Virus/*.plist

 

You may also have to delete /Library/Caches/com.sophos.sau -- but this is only as a last resort.

[AMC3]

Andrew, I ran all 3 Terminal scripts, then restarted. The lock icon in the Quarantine Mgr now works. However, I now have 2 Sophos icons in my menubar. What should I do to fix that? These same symptoms are occurring on all 3 the laptops in our home. (All are running OS 10.7.4)

Mac