Sophos Anti-Virus associated with unresponsive systems

Sophos on my MacBook and on Windows XP machines. Without any flaws

In my experience Sophos Anti-Virus is usually trouble-free on:

* PowerPC computers running Mac OS X 10.4.x through 10.5.8
* Intel computers running Mac OS X 10.5.x through 10.6.2
* computers running Windows XP, Windows Vista, Windows 7 RC.

I'm less interested in the reports of flawless behaviour (thanks),
more interested in identifying the factors that might prevent the operating system etc. from working with Sophos Anti-Virus:

* occasionally, on colleagues' computers running Mac OS X; nowadays, touch wood, we see this rarely but past reports include:

boots up and the desktop appears but it will not open anything - all i get is the 'beachball' rotating continually. (January 2009)

Beach-ball going around for a day and a half! (February 2009)

* far too frequently on my computer running Mac OS X 10.6.x:

Model Name: MacBook Pro
Model Identifier: MacBookPro5,2
Processor Name: Intel Core 2 Duo
Processor Speed: 2.66 GHz
Number Of Processors: 1
Total Number Of Cores: 2
L2 Cache: 6 MB
Memory: 8 GB
Bus Speed: 1.07 GHz
Boot ROM Version: MBP52.008E.B05
SMC Version (system): 1.42f4</pre>

best to avoid that app

Whilst my situation causes me to avoid Sophos Anti-Virus on my laptop (I install it only rarely, to see whether I'm still bugged), there's no immediate reason for other people to avoid it. Note in particular that

In fairness I do have some input managers and debatable things installed

We're licensed users so I'd like to resolve, or a least explain the issue.

In the meantime, on my own laptop, I use ClamXav Sentry.

There aren't any Mac viruses

Please find a separate topic for that discussion. Thanks.

whether the "account and login" forum is really the best place to ask.

I did hesitate before using this area, I think it's closest to my situation. The bug bites:

* after login
* before I can use my account.

(I guess, Apple steers discussion of third party software away from Apple Discussions, but there's no easy starting point when we're considering possible conflicts between multiple titles.)

detail about the "input managers and other debatable things"

At <http://www.wuala.com/grahamperrin/public/Apple/discussions/11148356>
file 2010-03-01-a.txt should give a rough idea but please note that not all of the launch agents and daemons are enabled.

2010-03-01-b.txt lists the jobs currently loaded into launchd.

I can't provide a System Profiler report at the moment (sorry), I might do so later.

AFAIR at times over the past year or so I have experimented with setting aside input managers and scripting additions.

AFAIR Sophos Anti-Virus is (properly) inactive when I start in safe mode, so in this case safe mode does not help us.

<http://www.wuala.com/grahamperrin/public/Sophos/1376797> reminds me that I have experimented with a wide variety of preferences, set:

a) normally, through the Sophos UI

b) experimentally, by relaxing the launch daemons for Sophos … but AFAIR any changes made here are ultimately overwritten when Sophos updates itself.

Using the Sophos UI to set preferences, I found no set of preferences that made things completely reliable. Some preference sets might defer the problem but eventually, a log in to Mac OS X will be followed by a beach ball.

Amongst the launch agents that are currently disabled,
net.redirectme.perrin.opensnoop-Sophos.plist
uses opensnoop in an attempt to identify the points at which the beach ball begins. In a nutshell: I have on a USB flash drive a volume named

debug

and with that flash drive connected to the computer, before log in to Mac OS X, the launch agent uses opensnoop to log +file open+ activity. Some time after the beach ball begins — and when I'm fairly certain (from the LED of the drive) that internal and external disk reads/writes have ceased — I force a stop, start in safe mode, uninstall Sohpos, start in normal mode, take a look at the log on the flash drive to see how 'far' things got before the beach ball began.

This approach is not wholly reliable; the requirement to force a stop of the computer means that I must rely on HFS+ journalling on the flash drive to get as much as possible of what was logged by opensnoop before the system stopped responding. I can probably retrieve the related logs but to be honest, they weren't conclusive — from logs of multiple incidents, I hoped to find something in common but AFAIR there was too much variance to draw any conclusion.

My gut feeling at the moment is that the problem occurs only when FileVault is enabled.