Sophos 8.0.1c - cannot enable on-access scan

You'll need to re-install all software that launches services at startup/login, as you've blown away everything in your LaunchAgents and LaunchDaemons folders.  These folders are where the load instructions are stored for services and applications that are designed to load during the startup process.

If you're running Time Machine, you can probably restore the items in those folders specific to the applications you're having problems with (in this case, Sophos and 1Password )

For Sophos, you'll want to re-install:

/Library/LaunchDaemons/com.sophos.autoupdate.plist    (updates)

/Library/LaunchDaemons/com.sophos.intercheck.plist      (on-access and more)

/Library/LaunchDaemons/com.sophos.notification.plist     (notifications)

--The main guide is to restore the com.<company> plist files that line up with your applications that are having issues.

@Andrew: thanks for your great response.

Funny that the Apple Care person said that there would be no problems from deleted any of those things; I understand caches would be rebuilt and assumed the same on the other folders. However, he did not say that I would have to re-install or re-configure anything.

I have him a "good grade" on the after survey right away; would like to have a do-over on the survey and I would ding him for misrepresenting what reinstall/reconfiguration was going to be needed.

At this point I did the following reinstall/reconfiguration which was needed to restore funtionality:

1. Sophos - required reinstall and it is working now.

2. Little Snitch - reinstalled and it is working now.

3. 1Password Helper - would not work until Opt-Cmd-Q of browser and restart; working now.

4. Parallels 7 - required reinstall; working now.

There may be more things that show up later that will also require reinstall/reconfiguration.

I am thinking that the Sophos recovery from Time Machine may or may not be necessary and would like your advice on that. I suppose there might be an odd setting or two that I have not made that would be restored from the plist files, but at this moment I am not overly concerned with that.

One side note of the cleanup that I did -- the system seems to be more responsive. Lion is really a slug IMHO; so anything that improves response is a plus.

I'd suggest going through those folders in Time Machine and seeing what files are currently missing that you used to have.  The files are usually descriptive enough so that you can figure out what product they belong to.  This will tell you what else you may need to reinstall or restore from backup.

As for your caches folders, there *are* a few things you can lose by clearing these: font groupings are one of them, and there are a few others.  Nothing earth shattering, but a few things may behave slightly differently than they used to before the purge.

Hi

I´m having the same problem: on-access scan won´t be enabled (after reboot).

In my case the problem (and answer) seem to be following:

If I reboot my computer and internet connection is turned off (Wi-Fi in my case) on-access scan won´t be enabled.

If Wi-Fi is on and I reboot my computer a process called InterCheck (Little Snitch tells me this) can connect to internet and on-access scan gets enabled.

Can anyone else test if the problem is located at the InterCheck and internet connection?

Thanks for the specific details.

I looked into the /Library/LaunchDaemons folder, and the 3 files you list are already there, and I did a binary comparsion to the files in Time Machine from a point prior to the recovery operation. The 3 files were identical. So the reinstall process apparently recreated them, and I had nothing different from the defaults apparently.

However, your other advice to look for other applications might be very valuable as well. I am wondering in the case of a file that is missing could simply be copied back. Also, whether I should apply this advice to each of the four folders (LaunchDaemons and LaunchAgents in both /Library and ~/Library).

As and addendum to my last post:

I went ahead and judiciously checked all the files. Several were identical. Several were just missing, so I copied them back in.

It turns out that a number of the files were present but the file names had been modified to having ".SM.gul." prepended to the name. Note the leading period. I did some research on this and apparently is it related to either a crash or malfunctioning of the System Migration utility. Please note: this has nothing to do with Sophos and is thus a bit off topic.

It appears to be safe to delete all such files, which I did after keeping a paranoia backup. It was quite a chore, as there were over 600 such files scattered throughout the system. After a lot of messing around eventually used sudo find ... exec rm ... to do the deed.

My thoughts exactly... *confused*

---

captkarma wrote:

We are using Mac's so there is no Control Panel so no tab which says "Groups"!

---

No luck here. I receive a "On-access Scanner failed to set preference" prompt with any preference change.... :(

---

curtyvr wrote:

I had this problem too.  Here's how I solved it:

1/Went to Sophos Preferences.  Chose "Live Protection" tab and unchecked "enable live protection".

2/Went to On Access Scanning tab and miraculously it was enabled.

3/Returned to Live Protection tab and checked "enable live protection"

4/Returned to On Access Scanning tab and it remained enabled.

Hope this helps!

---

I am having the same issue with the on access scanning all of a sudden being turned off.  I am sure there are many others who are not even aware that this has happened.  I know for me it took me some time to catch and I put off working on it.  As a IT security person I have questions as how this could happen?  Did something malious disable the scanner?  What is the root cause and how is it fixed?  I would like to see some real directions posted on how to fix it.  Not just guesses.  Thx.  Right now I don't trust the product to be doing its job correctly.  Where can I find the directions to completly remove it from my system?

---

skydivecm wrote:

I am having the same issue with the on access scanning all of a sudden being turned off.  I am sure there are many others who are not even aware that this has happened.  I know for me it took me some time to catch and I put off working on it.  As a IT security person I have questions as how this could happen?  Did something malious disable the scanner?  What is the root cause and how is it fixed?  I would like to see some real directions posted on how to fix it.  Not just guesses.  Thx.  Right now I don't trust the product to be doing its job correctly.  Where can I find the directions to completly remove it from my system?

---

The scanner recently did a major version update, which includes as part of the update process turning off the on-access scanner.  It appears the updater had issues re-enabling it after the update -- it SHOULD give you an alert in such a case.  Does rebooting the machine and running a manual update fix the issue?

To completely remove it from your system, run the Sophos Remove.app application in your Applications folder.