Unable to complete login after reboot

mdoorkeeper wrote:

> unable to login … The whole computer would hang and become

> completely unresponsive to any interface just after launching Finder.

I'm very familiar with this behaviour. There's a hint of this in my post 

things stop responding — without Boot Camp

towards the tail of a long topic that may be mostly about … Boot Camp.

> force shutdown using the manual button in the top right corner. 

Hint: http://en.wikipedia.org/wiki/Control-Alt-Delete#Mac is recently updated. I can't find a technical explanation of how a forced restart (three fingers) is more graceful than a forced stop (one finger), but I'm fairly certain that there is a degree of grace. 

A three finger salute forced restart is typically followed by audible disk activity. I take this as a sign of the software/firmware/hardware doing its best to make things sane before the stop and chime time. 

I have forced restarts often enough without SAV to not worry excessively about data loss/corruption (I have backups, and so on). Whenever possible I'll ssh from another computer, to mine, then kill things in a fairly orderly way. 

In contrast: when SAV causes me to force a restart, I often find corruption of preference files for Finder and other applications that seem to struggle, at login time, in the presence of SAV. 

> rebooted in Safe mode, and uninstalled Sophos AV.  

For any computer that's bugged in this way, I would make the same recommendation. Disk repairs, disk image repairs, recreation of preferences, restoration from backups of FileVault etc. can be unexpectedly time consuming.  

> It has been suggested on another forum that the problem is that

> my computer was not connected to the internet

> at the time I restarted. 

In my experience: I doubt that. 

I have tested in a wide range of networked and offline environments, and with probably all possible configurations of SAV. 

> '08 Macbook 13" aluminum with 4gb RAM, running OS X 10.6.4

Here: 17" MacBook Pro, Intel Core 2 Duo, 8 GB RAM, Snow Leopard. 
In the past I saw this type of bug bite a few other Macs, just occasionally. Nowadays AFAICT it's only me (and you?) who get bitten. 

mdoorkeeper, a question for you. Ignoring Boot Camp for a moment: 

• do you use FileVault?

Um, yeah, I do use File Vault.  I do not use Boot Camp.

Hi i found that same issue (installed and Sophos was running fine until i decided to logoff and than log in again, and as soon as the wallpaper showed up and the doc , the whole system became absolutely unresponsive (toolbar was just starting to load up; finder symbol date, time etc) and then i had beachball and i was forced to do hard reboot by holding power button)

Anyway i found this issue did NOT came up when i did boot my MacBook in 32 bit (usually i ALWAYS hold down the 6+4 button during boot so the "kernel_task" would boot in 64bit, so when i stopped doing that so my MacBook would boot in 32bit after log in everything just startet fine inclusive Sophos.

It was wired but i was able to reproduce this behavior a couple times: Boot in 64bit, sophos would hang and kill whole system during launch after logging in, boot in 32 bit everything was working FINE.

so my conclusion was that there is some issue with 64bit, and i would love if you could find and fix that bug, cause i like Sophos a lot and would like to use it again (and i am very balky when it comes to "just start in 32bit doesnt make a difference anyway" and i say NO i WANT to boot my mac in 64 and Sophos would not be the first Software that i like but stopped using cause it is not working with on my 64bit (i dont care if Sophos runs in 32/64bit itself) but if it keeps me from using my MAcBook in 64 it will lose ;)) 

but so far good job.

best

Ole

P.S Use FileVault but NO BootCamp (but could not see how FileVaulte would have to do with it cause as long as boot in 32bit there was no problem at all)

---

OleZimmer wrote:

… wallpaper showed up and the doc , the whole system became absolutely unresponsive (toolbar was just starting to load up; finder symbol date, time etc) and then i had beachball and i was forced to do hard reboot by holding power button)

… able to reproduce this behavior a couple times: Boot in 64bit, sophos would hang and kill whole system during launch after logging in, boot in 32 bit everything was working FINE.

… FileVault but NO BootCamp …

… could not see how FileVaulte would have to do with it …

---

http://diigo.com/0dlmn for highlights from 

Sophos Anti-Virus associated with unresponsive systems

I have seen the symptoms on a number of computers that have FileVault enabled, including Snow Leopard environments that are not 64-bit capable.  

OleZimmer, I suspect that sooner or later (within a month, maybe sooner) you'll suffer a repeat of the bug whilst your computer is in 32-bit mode. Be thorough with your backups and be prepared to restore Finder preferences etc..

To the best of my recollection, accounts without FileVault are never bugged in the way described in this topic.

On each computer that I administer, I routinely have:

• a preferred account for administration, with FileVault enabled
• a second account for administration, without FileVault. 

well i hope i wont suffer because i removed Sophos.

Wel but i just told you what happend, i was able to login just fine into my FileVault activated account after booting in 32bit.

but maybe my "tests" were n´t robust enough,  so i hope Sophos is gonna fix that issue and everything will be better ;)

best

---

OleZimmer wrote:

… maybe my "tests" were n´t robust enough …

---

I don't doubt the robustness of anyone's tests :-)

I could have put things better, sorry. I suppose what I want to say is that for this particular bug (requiring a forced restart or forced shutdown — after login to Mac OS X, and before the logging-in user can use the system) don't spend too much time trying to figure out what's going on. I have spent many hours trying to get perfectly reproducible steps to the bug, and trying to pinpoint the stage at which the bug bites, but the stage does vary significantly —

• at worst, the computer stops responding after presenting the desktop background (no menu bar, no Dock, no trace of ~/Desktop files)
• at best, the computer stops responding after presenting much more (the desktop background, partially populated menu bar, Dock, icons and maybe some previews of ~/Desktop files) 

Hi OleZimmer, and welcome to the forums.

From what I can tell from reading your description of the problem, I understand that:

1) When logging in in 64-bit mode, your MacBook becomes unresponsive.

2) The MacBook is protected by FileVault.

Two questions:

1) Have you got any login items for the account which was accessed when you logged in in 64-bit mode? (These should be listed in  System Preferences -> Accounts -> Login Items).

2) Has the On-access scanner started before the system becomes unresponsive? There should be an entry such as:

Nov 11 09:26:09 localhost com.apple.launchd[1]: *** launchd[1] has started up. ***

in /var/log/system.log. The entry immediately prior to this entry should tell us when the system locked up. If there is an entry prior to this in /Library/Logs/Sophos Anti-Virus.log before this date (but after the date of the previous login) such as:

com.sophos.intercheck: Info: On-access scanner started at 09:26 on 11 November 2010

then the On-access scanner had started up successfully.

Thanks in advance,

David

PS: Anyone suffering from the same symptoms (FileVault installed, unable to login after a reboot), answers to the above two questions may allow Sophos to narrow down the problem. Thanks!

I removed ProtectMac Antivirus, 

In the system.log extract for that 2010-11-12 00:43 incident, I'm not overly focused on the 

INSERT-HANG-DETECTED

in the closing line. Google finds many matches for that expression and I don't recall this particular search/match for any previous incidents. 

Incidentally Spotlight was busier than usual, at login time of the second incident, only because the first incident evidently corrupted Spotlight index files — that's something I forgot to mention in the previous post. 

(The current estimate in the Spotlight menu is about 28 hours remaining but maybe the progress bar will leap ahead at some point.)

Also the LaCie Big Disk Extreme triple interface, four volumes, that was probably connected via USB at the time of one of the two incidents is no longer recognised in the usual way. Now in System Profiler: instead of recognisable details for the device, and details of the four volumes, I simply see: 

TUSB6250 Boot Device:

  Product ID: 0x6250

  Vendor ID: 0x0451  (Texas Instruments)

  Version: 3.00

  Serial Number: AC577E850B0B

  Speed: Up to 480 Mb/sec

  Manufacturer: Texas Instruments

  Location ID: 0x24100000

  Current Available (mA): 500

  Current Required (mA): Unknown (Device has not been configured)

This might be pure coincidence — with this particular LaCie for the past week or so I have used a temporary adapter (the proper adapter gave up, as so many LaCie adapters seem to). I'll know for sure when I receive a replacement adapter. Hopefully just coincidence but my guts tell me thatthat the hang or the forced restart did something ugly to the firmware and/or drives. (I've seen firmware on a similar dual-disk (internal RAID?) LaCie spoilt once before, when the power supply was accidentally pulled during a write.)