Running scan but not completing

Hi tobyw7,

Thanks for the note. Can you provide a bit more detail by what you mean "never completes" e.g. it is stuck in the middle of the scan? It runs but then resets to "not running" state by itself?

It happens with me, too. I start it and it starts running, but when I check on it again after 30 mins - 1 hour, the window is gone and the scan never completed. 

ETA it doesn't give any error message. It just stops with no notification.

I have been running a scan local drives now for 10 hours ( overnight) and less than 20% has been done is this normal? I still have over 2 million items to go. I have a Mac running OS X 10.8.3 (12D78).

Hi rodger149,

---

rodger149 wrote:

I have been running a scan local drives now for 10 hours ( overnight) and less than 20% has been done is this normal? I still have over 2 million items to go. I have a Mac running OS X 10.8.3 (12D78).

---

The answer is a definite "maybe" as it depends on your file content (archives are ISO images are much more complex to scan). Do you see the scan still churning through files? You can also check Activity Monitor, looking for a process named "SophosAVAgent" - this is the name of the process that should be doing the on-demand scans. If you see it running and using CPU cycles, everything is still running as expected.

Hi, I'm seeing the same hang others are reporting on my wife's Mac.  It's a 27-inch mid-2010, 2.93GHz core i7.  16G of RAM, 256G SSD, so it's a quick machine.

But the scan is looping, it's got one core running solidly.  It's been on 1,257,273 files to go for an hour so far.  Here's the output of "lsof -p PID" using the AVAgent PID:

COMMAND     PID USER   FD     TYPE             DEVICE  SIZE/OFF     NODE NAME
SophosAVA 15914 root  cwd      DIR                1,4      1734        2 /
SophosAVA 15914 root  txt      REG                1,4    210448  2020668 /Library/Sophos Anti-Virus/SophosAntiVirus.app/Contents/MacOS/SophosAVAgent
SophosAVA 15914 root  txt      REG                1,4    612656  2020654 /Library/Frameworks/SUMScanKit.framework/Versions/A/SUMScanKit
SophosAVA 15914 root  txt      REG                1,4  19022464   688289 /usr/share/icu/icudt49l.dat
SophosAVA 15914 root  txt      REG                1,4   1654784   727582 /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/com.apple.LaunchServices-0360.csstore
SophosAVA 15914 root  txt      REG                1,4    600576    10199 /usr/lib/dyld
SophosAVA 15914 root  txt      REG                1,4 222511104   726988 /private/var/db/dyld/dyld_shared_cache_i386
SophosAVA 15914 root  txt      REG                1,4   8184672  2020626 /Library/Frameworks/SAVI.framework/Versions/A/SAVI
SophosAVA 15914 root    0r     CHR                3,2       0t0      311 /dev/null
SophosAVA 15914 root    1w     CHR                3,2    0t2398      311 /dev/null
SophosAVA 15914 root    2w     CHR                3,2  0t230049      311 /dev/null
SophosAVA 15914 root    3u    unix 0x478da0f799bbf645       0t0          ->0x478da0f799bbf70d
SophosAVA 15914 root    4u  KQUEUE                                       count=1, state=0x2
SophosAVA 15914 root    5w     REG                1,4      6838  2023970 /Users/xana/Library/Logs/Sophos Anti-Virus/Scans/Scan Local Drives/2013-05-21 10:25:18 -0700.log
SophosAVA 15914 root    6u    unix 0x478da0f799bbf645       0t0          ->0x478da0f799bbf70d
SophosAVA 15914 root    7r  PSXSEM                          0t0          /sophos_15914_00000
SophosAVA 15914 root    8r  PSXSEM                          0t0          /sophos_15914_00001
SophosAVA 15914 root    9r  PSXSEM                          0t0          /sophos_15914_00002
SophosAVA 15914 root   10r  PSXSEM                          0t0          /sophos_15914_00003
SophosAVA 15914 root   11r  PSXSEM                          0t0          /sophos_15914_00004
SophosAVA 15914 root   12r  PSXSEM                          0t0          /sophos_15914_00005
SophosAVA 15914 root   13r     DIR                1,2       850        2 /Volumes/RoxMacHD
SophosAVA 15914 root   14r     DIR                1,2       170       25 /Volumes/RoxMacHD/.Spotlight-V100
SophosAVA 15914 root   15r     DIR                1,2       102 15901259 /Volumes/RoxMacHD/.Spotlight-V100/Store-V2
SophosAVA 15914 root   16r     DIR                1,2      2788 17523598 /Volumes/RoxMacHD/.Spotlight-V100/Store-V2/E9DCA0BE-8E52-4C9B-B75F-160E633BF4EA
SophosAVA 15914 root   17r     DIR                1,2       102 17523636 /Volumes/RoxMacHD/.Spotlight-V100/Store-V2/E9DCA0BE-8E52-4C9B-B75F-160E633BF4EA/Cache
SophosAVA 15914 root   18r     DIR                1,2       102 17523637 /Volumes/RoxMacHD/.Spotlight-V100/Store-V2/E9DCA0BE-8E52-4C9B-B75F-160E633BF4EA/Cache/0000
SophosAVA 15914 root   19r     DIR                1,2     23766 17523638 /Volumes/RoxMacHD/.Spotlight-V100/Store-V2/E9DCA0BE-8E52-4C9B-B75F-160E633BF4EA/Cache/0000/0000
SophosAVA 15914 root   20r     DIR                1,2      6494 32571408 /Volumes/RoxMacHD/.Spotlight-V100/Store-V2/E9DCA0BE-8E52-4C9B-B75F-160E633BF4EA/Cache/0000/0000/01f1
SophosAVA 15914 root   21r     REG                1,2    538776 32626689 /Volumes/RoxMacHD/.Spotlight-V100/Store-V2/E9DCA0BE-8E52-4C9B-B75F-160E633BF4EA/Cache/0000/0000/01f1/32626621.txt
SophosAVA 15914 root   25u    IPv4 0x478da0f778df40ed       0t0      UDP *:61913
SophosAVA 15914 root   26u    IPv4 0x478da0f777dad7e5       0t0      UDP *:54731

And an hour later, it's silently gone away, leaving the scan incomplete.  The log file it had opened shows no further activity from when it was looping earlier.

That's right - it runs but then resets to say 'This scan has never been run'

This is the same as with me

Hello GeekZero,

When was the last time you got a data update? In Sophos Anti-Virus.log (in Console) you will see something like "com.sophos.autoupdate: Update completed at 13:09:51 21 May 2013". I wonder if the data update came along and nailed your running scan?

Hi bobcook - I went looking and found first this in the console:

5/21/13 8:32:52.899 AM ReportCrash[28874]: Saved crash report for SophosAntiVirus[28540] version 8.0.8.1 (8.0.8.1) to /Library/Logs/DiagnosticReports/SophosAntiVirus_2013-05-21-083252_TedMac.crash
5/21/13 12:33:29.000 PM kernel[0]: Sophos Anti-Virus on-access kext unloaded
5/21/13 12:33:31.411 PM SophosAutoUpdate[30283]: AlreadyRegistered
5/21/13 12:33:33.357 PM com.apple.launchd.peruser.502[160]: (com.sophos.uiserver[30237]) Exited: Killed: 9
5/21/13 12:33:33.357 PM com.apple.launchd.peruser.502[160]: (com.sophos.uiserver) Throttling respawn: Will start in 7 seconds
5/21/13 12:33:36.116 PM sudo[31067]:     root : TTY=unknown ; PWD=/private/tmp/PKInstallSandbox.cBpj4G/tmp ; USER=ted ; COMMAND=/bin/launchctl load -w /Library/LaunchAgents/com.sophos.uiserver.plist
5/21/13 12:33:38.000 PM kernel[0]: Sophos Anti-Virus on-access kext activated
5/21/13 12:33:47.922 PM com.apple.launchd[1]: (com.sophos.notification[30744]) Job appears to have crashed: Trace/BPT trap: 5
5/21/13 12:33:48.249 PM ReportCrash[31079]: Saved crash report for SophosAntiVirus[30744] version 8.0.8.1 (8.0.8.1) to /Library/Logs/DiagnosticReports/SophosAntiVirus_2013-05-21-123348_TedMac.crash

Then I looked in that directory mentioned in the ReportCrash entry, and there were a LOT of entries in there.  Here's the key line one from the time I was running the scan

Application Specific Information:
*** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '*** -[__NSArrayM insertObject:atIndex:]: object cannot be nil'

So apparently something's definitely dieing.  I didn't find any updates slamming in at those times though.  How can I send you a bunch of these crash reports?