Sophos Anti-Virus for Mac Home Edition

[mdoorkeeper]

Hi,

I installed Sophos Anti-virus for Mac Home Edition yesterday.  Install went as expected.  I ran a custom scan on a small micro SD to try it out and it went well, so I ran a full system scan.  That went faster than expected - MUCH faster than ClamXav, so I thought, "I like this".  BUT!!!! When I went to restart my computer today, I was unable to login to my admin account.  The whole computer would hang and become completely unresponsive to any interface just after launching Finder.  I had to force shutdown using the manual button in the top right corner.  I then ran "Applejack", (which cleaned a HUGE cache file), and rebooted.  Same result, ie; hang after Finder launch.  Sooo, I forced shutdown again, rebooted in Safe mode, and uninstalled Sophos AV.  

It has been suggested on another forum that the problem is that my computer was not connected to the internet at the time I restarted.  My computer is a Macbook and I usually use it in a mobile environment, so I'm almost never connected to the internet when I reboot.

I like the product.  I've not had the slowdown issues I see posted here, in fact I was impressed by how fast it worked and how little CPU it used while running in the background, but until I can restart without problems, I'm afraid it will stay uninstalled.

FYI:  My computer is an '08 Macbook 13" aluminum with 4gb RAM, running OS X 10.6.4

[grahamperrin]

mdoorkeeper wrote:

> unable to login … The whole computer would hang and become

> completely unresponsive to any interface just after launching Finder.

I'm very familiar with this behaviour. There's a hint of this in my post 

things stop responding — without Boot Camp

towards the tail of a long topic that may be mostly about … Boot Camp.

> force shutdown using the manual button in the top right corner. 

Hint: http://en.wikipedia.org/wiki/Control-Alt-Delete#Mac is recently updated. I can't find a technical explanation of how a forced restart (three fingers) is more graceful than a forced stop (one finger), but I'm fairly certain that there is a degree of grace. 

A three finger salute forced restart is typically followed by audible disk activity. I take this as a sign of the software/firmware/hardware doing its best to make things sane before the stop and chime time. 

I have forced restarts often enough without SAV to not worry excessively about data loss/corruption (I have backups, and so on). Whenever possible I'll ssh from another computer, to mine, then kill things in a fairly orderly way. 

In contrast: when SAV causes me to force a restart, I often find corruption of preference files for Finder and other applications that seem to struggle, at login time, in the presence of SAV. 

> rebooted in Safe mode, and uninstalled Sophos AV.  

For any computer that's bugged in this way, I would make the same recommendation. Disk repairs, disk image repairs, recreation of preferences, restoration from backups of FileVault etc. can be unexpectedly time consuming.  

> It has been suggested on another forum that the problem is that

> my computer was not connected to the internet

> at the time I restarted. 

In my experience: I doubt that. 

I have tested in a wide range of networked and offline environments, and with probably all possible configurations of SAV. 

> '08 Macbook 13" aluminum with 4gb RAM, running OS X 10.6.4

Here: 17" MacBook Pro, Intel Core 2 Duo, 8 GB RAM, Snow Leopard. 
In the past I saw this type of bug bite a few other Macs, just occasionally. Nowadays AFAICT it's only me (and you?) who get bitten. 

mdoorkeeper, a question for you. Ignoring Boot Camp for a moment: 

• do you use FileVault?

[mdoorkeeper]

Um, yeah, I do use File Vault.  I do not use Boot Camp.

[OleZimmer]

Hi i found that same issue (installed and Sophos was running fine until i decided to logoff and than log in again, and as soon as the wallpaper showed up and the doc , the whole system became absolutely unresponsive (toolbar was just starting to load up; finder symbol date, time etc) and then i had beachball and i was forced to do hard reboot by holding power button)

Anyway i found this issue did NOT came up when i did boot my MacBook in 32 bit (usually i ALWAYS hold down the 6+4 button during boot so the "kernel_task" would boot in 64bit, so when i stopped doing that so my MacBook would boot in 32bit after log in everything just startet fine inclusive Sophos.

It was wired but i was able to reproduce this behavior a couple times: Boot in 64bit, sophos would hang and kill whole system during launch after logging in, boot in 32 bit everything was working FINE.

so my conclusion was that there is some issue with 64bit, and i would love if you could find and fix that bug, cause i like Sophos a lot and would like to use it again (and i am very balky when it comes to "just start in 32bit doesnt make a difference anyway" and i say NO i WANT to boot my mac in 64 and Sophos would not be the first Software that i like but stopped using cause it is not working with on my 64bit (i dont care if Sophos runs in 32/64bit itself) but if it keeps me from using my MAcBook in 64 it will lose ) 

but so far good job.

best

Ole

P.S Use FileVault but NO BootCamp (but could not see how FileVaulte would have to do with it cause as long as boot in 32bit there was no problem at all)

[grahamperrin]

---

OleZimmer wrote:

… wallpaper showed up and the doc , the whole system became absolutely unresponsive (toolbar was just starting to load up; finder symbol date, time etc) and then i had beachball and i was forced to do hard reboot by holding power button)

… able to reproduce this behavior a couple times: Boot in 64bit, sophos would hang and kill whole system during launch after logging in, boot in 32 bit everything was working FINE.

… FileVault but NO BootCamp …

… could not see how FileVaulte would have to do with it …

---

http://diigo.com/0dlmn for highlights from 

Sophos Anti-Virus associated with unresponsive systems

I have seen the symptoms on a number of computers that have FileVault enabled, including Snow Leopard environments that are not 64-bit capable.  

OleZimmer, I suspect that sooner or later (within a month, maybe sooner) you'll suffer a repeat of the bug whilst your computer is in 32-bit mode. Be thorough with your backups and be prepared to restore Finder preferences etc..

To the best of my recollection, accounts without FileVault are never bugged in the way described in this topic.

On each computer that I administer, I routinely have:

• a preferred account for administration, with FileVault enabled
• a second account for administration, without FileVault. 

[OleZimmer]

well i hope i wont suffer because i removed Sophos.

Wel but i just told you what happend, i was able to login just fine into my FileVault activated account after booting in 32bit.

but maybe my "tests" were n´t robust enough,  so i hope Sophos is gonna fix that issue and everything will be better

best

[grahamperrin]

---

OleZimmer wrote:

… maybe my "tests" were n´t robust enough …

---

I don't doubt the robustness of anyone's tests :-)

I could have put things better, sorry. I suppose what I want to say is that for this particular bug (requiring a forced restart or forced shutdown — after login to Mac OS X, and before the logging-in user can use the system) don't spend too much time trying to figure out what's going on. I have spent many hours trying to get perfectly reproducible steps to the bug, and trying to pinpoint the stage at which the bug bites, but the stage does vary significantly —

• at worst, the computer stops responding after presenting the desktop background (no menu bar, no Dock, no trace of ~/Desktop files)
• at best, the computer stops responding after presenting much more (the desktop background, partially populated menu bar, Dock, icons and maybe some previews of ~/Desktop files) 

— and whilst I have a few hunches of factors that contribute to the bug, the steps to reproduce the bug for me boil down to 'after I install Sophos Anti-Virus, sooner or later, on my computer when I log in to my account that's protected by FileVault, the computer will stop responding before I can use it'. Steps like that are so vague that they'll be of little use to developers, heheh. 

More detail to follow, maybe over an extended period. Watch this space :-)

Nearly the bottom line for this post:

troubleshooting this particular set of symptoms can be unexpectedly time consuming. Get into troubleshooting here only if you're perfectly happy with that loss of time, and a likelihood that what you're trying has already been tried. 

The bottom line:

the more people reproducing this bug, the merrier (for troubleshooting purposes) — in particular, I haven't tested in an (Apple supported) 64-bit kernel and extensions environment. 

[grahamperrin]

---

grahamperrin wrote:

… trying to pinpoint the stage at which the bug bites, but the stage does vary significantly …

… a few hunches of factors that contribute to the bug …

---

A question for Sophos

Shot in the dark.

If in the menu bar the shield wishes to animate itself very soon after the user logs in:

1. What does Sophos require, from the OS, to achieve the animation?
2. If those requirements are not fulfilled in good time — if the animation can not begin — how does Sophos respond?

Side note: reading a topic that's unrelated, I begin to wonder how all parts of the GUI of Sophos behave when loads/durations are unusually great. 

[grahamperrin]

---

grahamperrin wrote:

… a few hunches of factors that contribute to the bug, the steps to reproduce the bug … 

---

A question for people who have been bitten by this bug

A long shot. 

System Preferences… | Security | General

Is your virtual memory (a) normal, or (b) secure?

[DavidDoyle]

Hi OleZimmer, and welcome to the forums.

From what I can tell from reading your description of the problem, I understand that:

1) When logging in in 64-bit mode, your MacBook becomes unresponsive.

2) The MacBook is protected by FileVault.

Two questions:

1) Have you got any login items for the account which was accessed when you logged in in 64-bit mode? (These should be listed in  System Preferences -> Accounts -> Login Items).

2) Has the On-access scanner started before the system becomes unresponsive? There should be an entry such as:

Nov 11 09:26:09 localhost com.apple.launchd[1]: *** launchd[1] has started up. ***

in /var/log/system.log. The entry immediately prior to this entry should tell us when the system locked up. If there is an entry prior to this in /Library/Logs/Sophos Anti-Virus.log before this date (but after the date of the previous login) such as:

com.sophos.intercheck: Info: On-access scanner started at 09:26 on 11 November 2010

then the On-access scanner had started up successfully.

Thanks in advance,

David

PS: Anyone suffering from the same symptoms (FileVault installed, unable to login after a reboot), answers to the above two questions may allow Sophos to narrow down the problem. Thanks!