Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 74 replies
  • Subscribers 6 subscribers
  • Views 312264 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos stops working when my mac starts up

mikeroy22

Hope someone can point me in the right direction.

I'm using a mac (10.6.8) and have the latest sophos 8.04C - every time I close down my mac and restart it the next morning Sophos stops working and wont allow me to change anything at all via preferences. If I just put my mac to sleep there's no problem at all when it wakes up and sophos continues to work.

If I download the sophos software again everything works smoothly until the next time I shut down my mac ..........!

Maybe I'm missing something - perhaps I've got one of the settings wrong, perhaps my OS wont work with the latest sophos - I just don't know!

Anyone got any ideas?

Thanks in advance

:1007673


This thread was automatically locked due to age.
  • 0
    Aloha, Agile --
    I've been having much the same trouble with On-Access Scanner. The trouble started happening about the same time (maybe exactly the same time) as when I noticed that my Sophos shield had changed. At the time, I figured the new shield just indicated an update -- which in fact it did, according to what read on another thread here at Sophos.
    Here's my experience. Whenever I start or restart Sophos, my On-Access Scanner stops running. Furthermore, Sophos puts up a little window telling me that Sophos is not running at all, and that I don't have any virus protection.
    I'm running Tiger. Maybe, if it's possible, I should return to an earlier version of Sophos. Not sure how to do that, though.
    Anyway, here's the money quote from my Anti-Virus Log: "com.sophos.intercheck: Fatal Error: Unable to configure virus detection engine [0x01800000]". The next line says "Sophos cannot continue."
    I *have* been able to get my on-access scanner to work (hopefully) by restoring the defaults. At least the red button turns back to green. If you have any advice/recommendations, or if anyone else here has some suggestions, I sure would like to hear them.
    Many thanks for any help you can give.
    :1008355
  • 0

    I too began having this problem recently although I cannot say when it first started.

    Running 10.7.4 Server as of last week, but the problem manifested several weeks before that, possibly when I first updated to 10.7.4.

    I uninstalled SAV, then downloaded a fresh .dmg of 8.0.5C and reinstalled it. Initially the shield was black in color with the indicator of an arrow probably indicating an update in progress. Soon after that, the sheild went to gray with an 'S' and no 'X" and has stayed that way.

    From the Console log, these two entries appear to be pertinent:

    7/22/12 8:28:48.000 AM kernel: Sophos Anti-Virus on-access kext activated

    7/22/12 8:33:41.604 AM com.apple.SecurityServer: Failed to authorize right 'com.sophos.cleanup' by client '/Library/Sophos Anti-Virus/SophosAntiVirus.app' [131] for authorization created by '/Applications/Sophos Anti-Virus.app' [396]

    The SAV log does not show any errors.

    :1008363
  • 0

    UPDATE to my previous post:

    I worked on the problem a bit more and think I have it figured out.

    I wasn't aware that OS X Server installs ClamAV, an opensource AV checker. Some software such as Fink and Darwinports also install ClamAV. I found reference to ClamAV when I went further into the Console Log and figured that if Sophos AV didn't depend on it, it needed to go.

    The easy way to uninstall the ClamAV engine is to download and install ClamXAV, a GUI interface to ClamAV. It will overwrite the system-installed version. Restart, then use the uninstaller which comes with ClamXAV and it will successfully get rid of ClamAV.

    Restart and Sophos On-Access will perform as it was designed to.

    :1008373
  • 0

    I'm having the same problem. I using Sophos for mac home edition, which seemed to work well when I installed it about 3 weeks ago and then I got a Sophos message a few days ago telling me that the Sophos "On-Access Scanning is disabled."

    I'm running Sophos 8.0.5C on a 1 year old mac mini running OS X 10.7.4.

    I finally removed Sophos and reinstalled it yesterday and the on-accessing scanning was enabled. But, when I turned my mac on this morning, the problem had returned.

    I guess what I really want know is: Is this problem caused by a Sophos bug or is it caused by some new virus? Clearly, reinstalling Sophos every time I turn on my mac will be problem for me, since I turn it off every night.

    A few weeks ago somebody hacked into my Yahoo account, which is why I installed Sophos. I scanned my mac and no viruses were found 3 days ago, but I'm still feeling pretty paranoid?

    Anyone have an answer to my question above?

    Thanks.

    :1008375
  • 0

    Nact, I mentioned a procedure in the post previous to yours about this problem and how I fixed it.

    Check your Console Log and see if there are any references to ClamAV in the log. If you find any, follow the steps I outlined and that will probably fix your problem.

    Have a great day.

    George

    :1008385
  • 0
    Add me to the list of folks with this issue. I'd installed 8.0.6c last week, rebooted this morning and am now getting the "On-Access Scan Disabled" message. I'm not getting those errors in my system logs though. All I've got is: 7/28/12 11:50:30.875 AM installd: Installed "Sophos Anti-Virus" () 7/28/12 10:52:42.834 PM installd: Installed "Sophos Anti-Virus" () 7/29/12 8:54:36.093 AM installd: Installed "Sophos Anti-Virus" () 7/29/12 1:55:37.810 PM installd: Installed "Sophos Anti-Virus" () 7/29/12 7:56:46.127 PM installd: Installed "Sophos Anti-Virus" () 7/29/12 10:57:25.443 PM installd: Installed "Sophos Anti-Virus" () 7/30/12 1:58:08.721 AM installd: Installed "Sophos Anti-Virus" () 7/30/12 4:58:49.210 AM installd: Installed "Sophos Anti-Virus" () 7/30/12 8:15:11.111 AM SophosAutoUpdate: AlreadyRegistered 7/30/12 8:15:19.000 AM kernel: Sophos Anti-Virus on-access kext activated 7/30/12 8:21:01.980 AM SophosUIServer: Performance: Please update this scripting addition to supply a value for ThreadSafe for each event handler: "/Library/ScriptingAdditions/SIMBL.osax" 7/30/12 8:21:02.553 AM Sophos Anti-Virus: Performance: Please update this scripting addition to supply a value for ThreadSafe for each event handler: "/Library/ScriptingAdditions/SIMBL.osax"
    :1008544
  • 0

    Hmm... does everyone having this specific problem with the menu item have SIMBL installed?  Considering what SIMBL does (injects code into other applications) and the fact that it hasn't been updated since Jan 28, 2011, and the last fix that was related to the relevant code section was adding support for Snow Leopard, I'd suggest disabling it as a first test.

    Second thing to check is if it works with Live Protection disabled.

    :1008566
  • 0

    How does one go about temporarily disabling SIMBL? I'm wondering what even installed it in the first place.

    (footnote - I'm on 10.7.4)

    :1008578
  • 0

    Try moving /Library/Application Support/SIMBL/, /Library/ScriptingAdditions/SIMBL.osax and /Library/InputManagers/SIMBL.  The contents of the Application Support folder will give you a hint as to what installed it (that's where the bundles live that SIMBL injects).

    See http://www.macupdate.com/app/mac/18351/simbl/ for other user's feedback, and http://en.wikipedia.org/wiki/SIMBL for more information on what SIMBL actually does.

    :1008588