problems scanning USB drive/large folders - Mac OS X 10.6.x with iWork, iLife, multiple partitions

@ busterb

I'll be interested to see how this one fans out. 

Focusing please only on problems that you find with the Home Edition

(setting aside differences between editions): 

001. When problems with SAV occur during an on-demand scan: is the black shield in the menu bar animated (signalling for example an update) or static?

002. Do the problems with SAV affect one computer, or more?

003. What's the model of the computer, and it's specification?

004. When you install the OS, do you use 10.6 optical media or 10.6.3 optical media?

005. When you update to 10.6.4, which method do you use? 

006. Do you install Sophos Anti-Virus Home Edition before or after applying all Apple updates to the OS? 

007. Which version of iLife, Mr Bond? Do you install iLife before or after installation of SAV? 

008. Which version of iWork? Do you install iWork before or after installation of iLife? 

009. At which stages do you install Apple updates to iLife and Work?

010. When you partition the internal and external drives, do you use Apple Disk Utility? Which version? 

011. Is the internal drive partitioned during installation of the OS, or post-installation whilst started from the startup volume?

012. Do the problems with SAV affect one USB drive, or more?

013. What's the model/specification of the drive?

014. For any partition, internal or external, have you used a third party utility such as iPartition?

015. Other than USB drive(s), do you have any wired or wireless peripherals when problems with SAV occur?

016. Are all internal and external partitions HFS+ case insensitive and journalled?

017. Is VM normal or secure? 

---

grahamperrin wrote:

001. When problems with SAV occur during an on-demand scan: is the black shield in the menu bar animated (signalling for example an update) or static?

** REPLY : Solid, static black.

002. Do the problems with SAV affect one computer, or more?

** REPLY : More. I have tried it on four of my personal Macs, and I have yet to find any of them working. 

003. What's the model of the computer, and it's specification?

** REPLY : 3 iMacs with various Intel chips, one MacBook Pro, Intel chip

004. When you install the OS, do you use 10.6 optical media or 10.6.3 optical media?

** REPLY : Both. The most recent was from 10.6.3 media, to a freshly-formatted drive.

005. When you update to 10.6.4, which method do you use?

** REPLY : Straight Apple Software Update, direct from Apple.

006. Do you install Sophos Anti-Virus Home Edition before or after applying all Apple updates to the OS? 

** REPLY : After all updates.

007. Which version of iLife, Mr Bond? Do you install iLife before or after installation of SAV? 

** REPLY : Two have iLife '09, two updated to iLife '11. 

008. Which version of iWork? Do you install iWork before or after installation of iLife? 

** REPLY : iWork '09. Installed after iLife on two machines, before on two. 

009. At which stages do you install Apple updates to iLife and Work?

** REPLY : Immediately after installation. Might as well update the whole kit in one go.  

010. When you partition the internal and external drives, do you use Apple Disk Utility? Which version? 

** REPLY : Whatever version of ADU was on the 10.6 and 10.6.3 disks.

011. Is the internal drive partitioned during installation of the OS, or post-installation whilst started from the startup volume?

** REPLY : Don't be daft. Nobody in their right mind would partition afterward. Like buying trouble, do you? :-)

012. Do the problems with SAV affect one USB drive, or more?

** REPLY :  More. Tested with three different external HDs from three different manufacturers. 

013. What's the model/specification of the drive?

** REPLY : Toshiba 80 GB, Seagate 250 GB, Western Digital 500 GB.

014. For any partition, internal or external, have you used a third party utility such as iPartition?

** REPLY : No.

015. Other than USB drive(s), do you have any wired or wireless peripherals when problems with SAV occur?

** REPLY : Apple Keyboard & Mouse, Apple Airport. That's it.

016. Are all internal and external partitions HFS+ case insensitive and journalled?

** REPLY : Yes, internal. No, external. Two of the three externals are actually MS-DOS. Don't really see what that has to do with the price in China, actually. 

017. Is VM normal or secure? 

** REPLY : Normal. 

---

Thanks for the speedy responses and your good humour about the more obscure questions. I'll catch up with this one later. 

Briefly before I forget: hints at http://openforum.sophos.com/t5/Sophos-Anti-Virus-for-Mac-Home/System-becomes-unresponsive/m-p/255#M209 re: command line scanning with results to a log, and taking note of what's on screen at the time of a hang, could be useful in your case. 

There was a fairly pertinent question 018 but it's completely gone from my mind at the moment!

Late night, long shots …

018. Probably not a question I should ask, but what happens if we point a web browser at the root of one of the servers that's used for updates of the Home Edition and we assume https? 

https://es-web-4.sophos.com.edgesuite.net/

http://www.wuala.com/%23%23Sophos-Mac/2010/11/11/a screenshot 001 looking at port 80 the https assumption is probably wrong. 

Side note:

The certificate for savmacfree.register.sophos.com is invalid

---

grahamperrin wrote:

018. Probably not a question I should ask, but what happens if we point a web browser at the root of one of the servers that's used for updates of the Home Edition and we assume https? 

Oh, bloody hell did my Mac hate that one : 

"Safari can't verify the identity of the website "es-web-4.sophos.com.edgesuite.net". The certificate for this website is invalid. 

Ok, an opportunity here. I have to reformat the iMac that is most problematic with Sophos. Shall I try just a 10.6.3 install and update to 10.6.5? Just keep the ball in Apple's court, so to speak...

---

busterb wrote:

---

grahamperrin wrote:

018. Probably not a question I should ask, but what happens if we point a web browser at the root of one of the servers that's used for updates of the Home Edition and we assume https? 

Oh, bloody hell did my Mac hate that one : 

"Safari can't verify the identity of the website "es-web-4.sophos.com.edgesuite.net". The certificate for this website is invalid. 

---

OK so that matches my screenshot 002 but considering the port 80 shown by Little Snitch, this certificate issue (probably relating to a different port for https) may be negligible. 

---

busterb wrote:

… I have to reformat the iMac that is most problematic with Sophos. Shall I try just a 10.6.3 install and update to 10.6.5? 

---

Going ahead with that test should be good if you have the opportunity and don't mind the time. Keep it very, very plain without iLife, iWork etc., minimal peripherals and a single partition. 

The peripherals thing is probably way off mark in these rounds of tests, but very rarely in the distant past (off-topic from Sophos for a moment) I've seen a consumer Mac, or Apple server hardware, misbehave when the Apple keyboard attached is different in some way from the Apple keyboard that was bundled. Strange but true. Postscript: another strange but true example from the distant past was the sometimes pernickety/unpredictable behaviour of early Apple-installed FireWire in PowerPC towers. And so on, just rarely an issue is in the least expected place (we're so accustomed to Apple-provided hardware combinations just working in combination, the last thing on ours minds is that the combinations might not work 100%). 

Back to SAV: go for the cleanest minimalist installation then try the command-line approach to (hopefully) catch a point at which things stop responding. 

---

grahamperrin wrote:

Go ahead with that test should be good if you have the opportunity and don't mind the time. Keep it very, very plain without iLife, iWork etc., minimal peripherals and a single partition. 

(snip)

Back to SAV: go for the cleanest minimalist installation then try the command-line approach to (hopefully) catch a point at which things stop responding. 

---

Oh, bloody hell - you aren't going to believe this. I cannot - REPEAT - cannot get Sophos to lock up now. 

RECAP :

Zeroed out the drive.

Formatted single partition.

Installed 10.6.3 from DVD media. Custom install, bare-bones system only. No printer drivers, no Rosetta, nothing but the basic OS. 

Upgraded 10.6.3 to 10.6.5 via Software Update. Refused all other updates. 

Restarted computer. Hooked up external 500 GB drive. 

Initiated manual scan via the GUI, 101.6 GB folder on the external drive. 

Sophos will not slow down the computer. In fact, it ripped through the scan in under 30 seconds. This is the blazing fast, rock-solid Sophos I am used to. 

Take-away lesson : Either something was introduced in 10.6.5, or something was removed that was in 10.6.3 and that something was causing the problems. I will update my other Macs via Software Update and see if I can replicate the (now) non-issue. The proof should solidly be in that custard. 

In the meantime, I am going to take this Mac back to it's original configuration (two partitions, iLife '11 and iWork '09) update the whole kit, and see if I have the same results. God willing, the demons will be gone and I will go back to having the pleasure of having Sophos protect my Macs. Just as God intended, he added parenthetically . :-)

Hi there,

my Mac totally freezes when scanning (iMac, 10.6.5, > 2.500.000 files, boot camp, vm ware fusion evaluation, recently installed sophos home edition). Smaller folders work without problem.  I noticed that the scanning process takes sometimes close to 100% of the CPU time. I have to have a look at the details of the questions & answers provided here ... I will follow up here,

Regards, S.