Sometimes (about 2-3 times a month) my Macbook Air displays the spinning beach ball in more and more applications until everything hangs and I have to restart. This happens on my family's other Macs, too. A few months ago I noticed that everytime this happens, the Sophos icon in the menu bar indicates that Sophos is currently updating. I checked my theory and indeed, every single time one of the Macs crashes, Sophos is doing an update. This cannot be a coincidence.
I then tried to find out what exactly happens and why all apps are crashing. I found out that they cannot access the hard drive anymore. They continue to work fine as long as they do not access the disk. As soon as they try to load anything from the disk, they stall and display the beach ball.
Usually, everytime an app wants to access the hard drive, Sophos intercepts this attempt, scans the file for viruses first and then allows the app to read it. I believe that there's some kind of bug in the Sophos update code that sometimes (usually updates work fine) makes Sophos intercept hard drive accesses without ever scanning and unblocking them.
This serious bug was affecting the commercial Sophos Anti-Virus 7 which my university used till last month, and it still affects Sophos Anti-Virus 8. It also affects the home edition of Sophos Anti-Virus 8 which all my family members use. We all use Mac OS X Lion and regularly update it.
The log files on a crashed computer look like this:
27.06.12 10:48:38,372 installer: Package Authoring Error: Infinite loop between <choice> attributes and mixed state aborted.
27.06.12 10:48:39,439 installer: Configuring volume "Mac OS X"
27.06.12 10:48:39,452 installer: Free space on "Mac OS X": 10,32 GB (10324697088 bytes).
27.06.12 10:48:39,452 installer: Create temporary directory "/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//Install.4959z5UUG"
27.06.12 10:48:39,460 installer: IFPKInstallElement (19 packages)
27.06.12 10:48:39,866 installd: PackageKit: ----- Begin install -----
The next entries happen after the restart.
This thread was automatically locked due to age.
