Sophos Anti-Virus for Mac Home Edition

[mdoorkeeper]

OK, so if I understand you and Kimipooh correctly, I must set the "WorkerThreads" to a number greater than my login items. Yes?

I'm a bit leery about trying to drive my computer with Terminal as I don't really know what I'm doing.  I don't speak UNIX, but I do know that "sudo", if used incorrectly, can REALLY **bleep** things up, big time.  The few times I've ventured there, I was essentially just following step-by-step directions with no real knowledge of just what I was telling my computer to do, then crossing my fingers and hoping for the best.  Also, I have no idea how to restart the service through Launchd...whatever that is, so unfortunately, David, most of your post is gibberish to me.  Not your fault of course, it's my ignorance.  

Thanks anyway, but I guess I'd better wait until Sophos gets around to fixing sav so that it works with File Vault out of the box, so to speak.  Although I'm fanatic about backing up, having to reinstall the OS is a real hassle.

[grahamperrin]

Re Sophos Anti-Virus for Mac OS X release notes for version 4.9.12 (RTF, 2008):

Known problems with this version

• (DEF 19925) On OS X 10.5.x with FileVault enabled, the on-access scanner can cause deadlocks.

• how was DEF 19925 resolved?

http://diigo.com/0drrs for highlights from http://www.schollnick.net/wordpress/macintosh-related/file-vault-information and I'm distinguishing between:

1. deadlocks in general 
2. deadlocks following login

— both of which were associated with SAV on-access scanning in 2008. 

Re archived Stuck in "loop" or "hang" after login (highlights) (2008):

> Turning off Sophos (not just the moving of files but also active scanning)

> solved the problem

— and re Leopard hangs after login - solved (FileVault, Sophos) (highlights) (2009):

> turn off Sophos active scanning "on access"

please note that for me, in multiple tests, disabling on-access scanning was not a reliable workaround. 

[grahamperrin]

kimipooh wrote:

According to Sophos Japan … I understood as follows.

… (Default 4 thread --> 15 thread) …

---

grahamperrin wrote:

• how was DEF 19925 resolved?

---

Please:

if the default number of WorkerThreads (4) has not increased,

then how was that 2008 issue resolved?

[DavidDoyle]

The resolution to DEF19925 was to increase the default number of Worker Threads on 10.5+ to 10. This worked around the original issue and was felt to stop all but an extremely large number of login items (greater than about 15) from causing a similar kernel panic.

Considering the rather low number of login items being discussed in this thread, however, I'm inclined to think there is a different underlying root cause.

[grahamperrin]

David, thanks for the open and honest response. 

Some criticism below, please don't take it personally. 

"… all but …"

To have a known issue, that's not listed amongst the list(s) of known issues published by Sophos, is extraordinarily bad. Faith in Sophos is very dented. Many, many hours of my time, of my colleagues' time, could have been saved if Sophos had been open about the risk to the (maybe) small number of users.

On one hand: I might shoulder a little of the blame for the current situation. In 2009 I allowed a related call with Sophos to lapse when I didn't respond in good time. 

On the other hand: I was simply sick to death of the aggravation caused by the problem. AFAIR it was a busy time for me and I couldn't bear the prospect of long and complicated remedies (repairing the startup volume, repairing my FileVault home directory, restoring broken preference files etc.) following nearly every occurrence of the bug. All things considered I just put the call on the back burner, thinking I might get around to responding in time, but I didn't. 

Bottom line: if the Sophos person dealing with my 2009 call had been given a list of known issues that was truer, the call might have been progressed, even resolved, immediately. What a colossal aggravation and waste of time. 

[grahamperrin]

---

DavidDoyle wrote:

Considering the rather low number of login items being discussed in this thread, however, I'm inclined to think there is a different underlying root cause.

---

For a work colleague recently I configured a new MacBook Pro (well specified, plenty of RAM etc.). Sophos Anti-Virus installed. 

Before long, the bug bit. 

System Preferences… | Accounts | Login Items

showed only one item: the Sophos one 

— AFAIR SophosUIServer (All Users).

Since then, for installations of SAV in my Centre I set WorkerThreads to 20. I assume that increasing from 10, to 15 or 20, does not increase risk in any area; and I assume that wherever there's plenty of RAM the greater numbers of WorkerThreads will not cause excessive hogging. Increasing to 20 because there's uncertainty in this topic.  

----

Should we extend focus to any of the following areas?

~/Library/LaunchAgents/

~/Library/LaunchAgents/

/Library/LaunchAgents/

/Library/LaunchDaemons/

/System/Library/LaunchAgents/

/System/Library/LaunchDaemons/

The commandment "thou shalt not touch /System" is respected :-) I'd just like to get an idea of where next. 

At some point I may be steered away from the Home Edition area, towards support for enterprise customers. Apologies in advance for any extended silences. 

[risaer]

Hi, ----- EDIT: **bleep**. This **bleep** forum's rtf-editor just submits an empty post! Since I alway copy the text before I post something, here it is without formatings: ----- I have got the same problem: - after installation sophos worked well (at least no probs, found some test virusses) - after login, it takes a few seconds, some icons bumping, then: freeze working surroundings to get system working again (same as mentioned above but better to read, I think :-7): 1) **REBOOT** * Method 1: Press CTRL+APPLE+POWER (if I remember it right) * Method 2: press power button long -> bad, but always working 2) ** BEFORE you LOG IN **: a) after you pressed login, HOLD the SHIFT button to prevent autostart stuff to load b) uninstall or deactivate: use uninstaller to remove (in your Application folder) . You can also deactivate the Sophos start items, either manually or with Lingon My system: Snow Leopard, Filevault, Bootcamp

[desven]

Any news on that problem?

Even with the most recent version of Sophos AV, it still happens on many of our and our customers Macs.

As soon as I trun off On-Access scanning, the deadlocks are gone.

Thanks Sven.

[sidharth_das]

Hi,

I seem to be having some issues with my Mac, and I suspect a Sophos Anti-virus download yesterday (Thursday June,16, 2011 at round 9:00 - 11:00 AM GMT). I've detailed the configuration and the sequence of events, any help in this matter would be deeply appreciated:

(a) I use a Macbook PRO (Intel) running on OS X 10.5.8

(b) At around GMT 9:00 AM, I got a downloading message from the installed Sophos Anti-virus. It said "Downloading 1 of 1 file" with a file size of about 11.5M. I did not want the want the download then, so I cancelled the update. The download however went through for some reason, and ended up downloading the whole file. The download completed at around 11:00 AM GMT (I had an extremely low network bandwidth yesterday). I was working on some web servers and a microsoft presentation (Powerpoint for Mac 2008), when the Powerpoint presentation failed to save (i.e Powerpoint did nothing when I tried to save - no "save as"/"save" window that is.

(c) I closed all applications and restarted the computer when the powerpoint issue happened. After restart, the powerpoint recovered the file I was working on and allowed me to save it. I however noticed that my trashes folder had been cleaned after the restart. I worked some more, and then disconnected and put the computer to sleep at GMT 12:30 PM

(d) I again logged onto the Mac at round 6:00 PM GMT, and connected to the network. On opening my Yahoo connection, I got a error " Safari can't establish a secure connection". I got the same message for a couple of other https sites.

(e) I tried opening the Mac Mail, but it said that I needed to add a new email account to access (I have been using the macbook for a couple of years now and extensively use the mail application, so this was a complete surprise). I tried opening iPhoto, I got a message saying that the data could not be accessed. I got a bit worried that a virus had "totalled" all data on my macbook, and started running Sophos anti-virus, but abandoned it halfway though and rebooted the computer.

(f) After reboot, the login window says that the "Filevault-protected home folder has been damaged. Press OK to repair or Cancel to login as a different user". On pressing OK, it gives me a "Login application failed" message.

Since there's only one user on my Macbook, I'm basically stuck outside the macbook (cannot login). I booted in the single-user mode and did a file system check (fsck) and that showed everything was fine with the Macintosh HD.

Any help would be great!

Regards,

Sid

[Agile]

Out of curiosity, how much disk space do you have left?  df -h in single user mode should tell you.  When FileVault doesn't have enough space left to operate (it needs significcantly more than the enclosed volume), all the issues you've mentioned crop up.