9 Replies Latest reply: Mar 1, 2010 2:48 AM by thomas_r.
Graham Perrin Level 2 Level 2 (255 points)
This problem is not limited to Snow Leopard. I encountered it many times in 10.5.x.

On my laptop, and sometimes on other users' computers, an installation of Sophos Anti-Virus soon (or eventually) leads to beach balls from which there is no escape. Whenever this happens, only two actions are possible:

* force a stop (press and hold the power key); or
* force a restart (key commandcontrolpower)

— so I treat this problem as equal, in frustration/inconvenience, to a panic.

In my environment, and in some others:

1. install Sophos Anti-Virus

2. update Sophos Anti-Virus

3. restart Mac OS X

4. log in to Mac OS X

5. beach ball usually begins very soon after the Spotlight icon appears in the menu; the point at which things become unresponsive is not totally predictable, but it's never possible to use Finder or any other application

6. OS reacts only minimally to trackpad or mouse; the cursor moves, but clicks are ineffective

7. OS does not respond to normal keyboard input

8. OS does not respond to command-alt-escape; the +Force Quit Applications+ dialogue will not present

9. remote log in is enabled, but there is no response to ssh from remote computers

10. beach ball is endless; I have left computers for hours, sometimes overnight.

Consistently: if I start in safe mode to use the uninstaller at
/Library /Sophos Anti-Virus
then without Sophos Anti-Virus, the system is stable.

Attempts to resolve the issue with help from Sophos were not conclusive. In fairness I do have some input managers and debatable things installed, but it concerns me that any combination of software can bring the operating system to its knees, so I'm posting to Apple Discussions.

Maybe worth mentioning that I use FileVault.

Additional notes to follow.

Intel and PowerPC desktops and laptops, Intel and G4 Xserves, Xserve RAIDs, Mac OS X (10.6.2), Mac OS X 10.5.8 and 10.6.2, Mac OS X Server 10.5.8 and 10.6.2
  • Tom Gewecke Level 9 Level 9 (75,520 points)
    Thanks for that report -- sounds like it's best to avoid that app.
  • raimattern Level 1 Level 1 (95 points)
    I'm using Sophos on my MacBook and on Windows XP machines. Without any flaws !!

    Regards
    Rainer Mattern
  • Graham Perrin Level 2 Level 2 (255 points)
    Sophos on my MacBook and on Windows XP machines. Without any flaws


    In my experience Sophos Anti-Virus is usually trouble-free on:

    * PowerPC computers running Mac OS X 10.4.x through 10.5.8
    * Intel computers running Mac OS X 10.5.x through 10.6.2
    * computers running Windows XP, Windows Vista, Windows 7 RC.

    I'm less interested in the reports of flawless behaviour (thanks),
    more interested in identifying the factors that might prevent the operating system etc. from working with Sophos Anti-Virus:

    * occasionally, on colleagues' computers running Mac OS X; nowadays, touch wood, we see this rarely but past reports include:

    boots up and the desktop appears but it will not open anything - all i get is the 'beachball' rotating continually. (January 2009)


    Beach-ball going around for a day and a half! (February 2009)


    * far too frequently on my computer running Mac OS X 10.6.x:

    Model Name: MacBook Pro
    Model Identifier: MacBookPro5,2
    Processor Name: Intel Core 2 Duo
    Processor Speed: 2.66 GHz
    Number Of Processors: 1
    Total Number Of Cores: 2
    L2 Cache: 6 MB
    Memory: 8 GB
    Bus Speed: 1.07 GHz
    Boot ROM Version: MBP52.008E.B05
    SMC Version (system): 1.42f4</pre>
  • Graham Perrin Level 2 Level 2 (255 points)
    best to avoid that app


    Whilst my situation causes me to avoid Sophos Anti-Virus on my laptop (I install it only rarely, to see whether I'm still bugged), there's no immediate reason for other people to avoid it. Note in particular that

    In fairness I do have some input managers and debatable things installed


    We're licensed users so I'd like to resolve, or a least explain the issue.

    In the meantime, on my own laptop, I use ClamXav Sentry.
  • thomas_r. Level 7 Level 7 (30,470 points)
    Whilst my situation causes me to avoid Sophos Anti-Virus on my laptop (I install it only rarely, to see whether I'm still bugged), there's no immediate reason for other people to avoid it.


    Of course there is! There aren't any Mac viruses, and Snow Leopard includes protection for the few Mac trojans, so what purpose does anti-virus software serve?
  • Tom Gewecke Level 9 Level 9 (75,520 points)
    there's no immediate reason for other people to avoid it.


    Thanks for that clarification, I misunderstood the purpose of your post, which I thought was some kind of warning. Instead I gather you are trying to see if anyone can help you figure out what other stuff you might have on your machine which causes problems with Sophos. Perhaps it would be good to provide more detail about the "input managers and other debatable things" you have installed. Also you might want to consider whether the "account and login" forum is really the best place to ask.
  • Graham Perrin Level 2 Level 2 (255 points)
    There aren't any Mac viruses


    Please find a separate topic for that discussion. Thanks.
  • Graham Perrin Level 2 Level 2 (255 points)
    whether the "account and login" forum is really the best place to ask.


    I did hesitate before using this area, I think it's closest to my situation. The bug bites:

    * after login
    * before I can use my account.

    (I guess, Apple steers discussion of third party software away from Apple Discussions, but there's no easy starting point when we're considering possible conflicts between multiple titles.)

    detail about the "input managers and other debatable things"


    At <http://www.wuala.com/grahamperrin/public/Apple/discussions/11148356>
    file 2010-03-01-a.txt should give a rough idea but please note that not all of the launch agents and daemons are enabled.

    2010-03-01-b.txt lists the jobs currently loaded into launchd.

    I can't provide a System Profiler report at the moment (sorry), I might do so later.

    AFAIR at times over the past year or so I have experimented with setting aside input managers and scripting additions.

    AFAIR Sophos Anti-Virus is (properly) inactive when I start in safe mode, so in this case safe mode does not help us.

    <http://www.wuala.com/grahamperrin/public/Sophos/1376797> reminds me that I have experimented with a wide variety of preferences, set:

    a) normally, through the Sophos UI

    b) experimentally, by relaxing the launch daemons for Sophos … but AFAIR any changes made here are ultimately overwritten when Sophos updates itself.

    Using the Sophos UI to set preferences, I found no set of preferences that made things completely reliable. Some preference sets might defer the problem but eventually, a log in to Mac OS X will be followed by a beach ball.

    Amongst the launch agents that are currently disabled,
    net.redirectme.perrin.opensnoop-Sophos.plist
    uses opensnoop in an attempt to identify the points at which the beach ball begins. In a nutshell: I have on a USB flash drive a volume named

    debug

    and with that flash drive connected to the computer, before log in to Mac OS X, the launch agent uses opensnoop to log +file open+ activity. Some time after the beach ball begins — and when I'm fairly certain (from the LED of the drive) that internal and external disk reads/writes have ceased — I force a stop, start in safe mode, uninstall Sohpos, start in normal mode, take a look at the log on the flash drive to see how 'far' things got before the beach ball began.

    This approach is not wholly reliable; the requirement to force a stop of the computer means that I must rely on HFS+ journalling on the flash drive to get as much as possible of what was logged by opensnoop before the system stopped responding. I can probably retrieve the related logs but to be honest, they weren't conclusive — from logs of multiple incidents, I hoped to find something in common but AFAIR there was too much variance to draw any conclusion.

    My gut feeling at the moment is that the problem occurs only when FileVault is enabled.
  • thomas_r. Level 7 Level 7 (30,470 points)
    What discussion? I'm simply stating a fact.