Message says "Sophos Anti-Virus is not running"

When you check Activity Monitor, is InterCheck running?  How about SophosAntiVirus (as opposed to Sophos Anti-Virus)?  Do you still have a black shield iwth an S in your menu bar?

Yes on all counts. InterCheck and SophosAntiVirus are running and the shield icon is in the menu bar.

I'm getting the same message today for the first time since installing Sophos two months ago.  Running Lion 10.7.3 on 1 yr. old MacBook Pro.  All my setting check out as described by the previous post.  I've run "update", which worked. Logged off and back on and still not running.  I've got the shield with the S in it, but it's all grayed out.

I was mistaken -- I went back to check activity monitor and "interCheck" isn't running.  I've uninstalled Sophos, dowloaded it again and updated it, went back to activity monitor and "interCheck" still not there.  Sophos Anit-Virus is running with %CPU 0.2, Real Memory 17.7MB and Threads 11.  Sophos UI Server shows %CPU 0.2, Real Memory 15.2MB, and Threads 7.  My shield is now black, but because you asked if "interCheck" was running in activity monitor, and it's not in mine, I'm wondering if Sophos is actually protecting me live or if I'm just going to have to do more frequent scans.

The message also pops up if I log out, then log back in to my primary user account. The message appears a few minutes after login. Very irritating since I've been recommending Sophos to all my friends and clients, and telling them that Sophos "just works".

Update: Just restarted my computer again. This time the Sophos shield icon is no longer in the Menu Bar. Same message appeared a few minutes after restart. I'm going to uninstall Sophos, download it again and reinstall since I don't know what else to do. Anti-virus software that can't be relied on to always be on the job isn't worth much.

Hello Alan,

while UI issues should definitely not occur - as long as you can access the UI (Preferences) by whatever means it likely still works. To check the on-access component visit EICAR, go to ANTI-MALWARE TESTFILE and choose DOWNLOAD on the left and select one of the items. If you get an alert when downloading or trying to open the downloaded file (depending on your settings and the file) you can be sure that on-access works.

HTH

Christian

Thanks, Christian. I'll give that a try.

To be honest, I'm not overly concerned about being protected or not protected myself. Mac exploits that don't require a stupid move on the user's part are rare. But the confusion over the Flashback exploit convinced me to start recommending Sophos Anti-virus to my friends and clients. Most of them would freak out if they started seeing messages like the one I've been getting. The bottom line is that I don't want to have to explain to all of them what you've just explained to me. Hopefully, most Mac users aren't seeing this message.

I agree wholeheartedly with "alansky" -- your suggestion gets way too complicated for the average Mac user, which I am.  I've still not received any reply concerning what exactly "interCheck" does, and if it's lack of appearing in activity monitor should be a concern.  While I've been a Mac user now for 6 years, I've never felt the need to use security software and have always felt safe.  But I, too, began using Sophos due to the Flashback issue, and because it got such good reviews.  But if it's not going to be reliable, I might as well not use it.

My shield is still black.  It did an auto update check this morning as I'd requested.  All my preferences seem to be in order, but I just don't know for sure if the program is working as advertised.

To verify the program is working as advertised, go to wikipedia and search for eicar.  Download the sample on that page, and you should get a detection alert.  Don't worry -- eicar is a test file used across the industry to verify whether or not your scanner is functioning correctly.  The file does not actually do anything.