Message says "Sophos Anti-Virus is not running"

Hi rippje,

The kextunload command tells the kernel to "unload" (stop using) a particular kernel extension or device driver. You should be quite cautious with using this command with arbitrary kexts, very bad things could happen to your running system.

The launchctl command starts background daemons (or forces them to start, if the system had disabled them).

---

bobcook wrote:

"Note that this directory is normally not visible in the Finder. Press Command+Shift+G then type in the path "/Library" to go to that location directly."

Beg to differ, bobcook, the root level Library is not invisible. The user level Library is the one that's invisible.

I'm here because I installed Sophos two days ago and this self-disabling has happened to me twice now. The shield has an X in it, and Update Now and Cancel Update are both greyed out.

I think I may have solved my problem, at least. The Sophos log indicated some corrupt files in a cache. I deleted both Sophos folders in /Library/Caches/ and rebooted.

Sophos can now auto update and scan, and it hasn't eaten itself yet.

Hi cavenewt,

Did you have the same list of corrupt files as katulaj listed in the log? Unfortunately the error code listed isn't very helpful but its a good clue about the corrupt files. Thanks for the update. It would have been interesting to know what happened if you hadn't done the reboot. Or only done the reboot. In other words, which step resolved the issue for you: the the file deletion or the reboot.

bobcook: reboots did not do any good previously. That's always the first troubleshooting step, per Dogbert.

I looked for the corrupt file listed in the log and it did not exist in the cache folder. Since deleting cache and or plist files is another standard troubleshooting step, I just went ahead and trashed all the Sophos cache files.

Interestingly, in Console when I filtered for the word "corrupt", first I got about half a dozen listings (all of them indicating they were in the same cache folder). When I went back later without closing Console in the meantime, I only got one entry. The log file had not rolled over. 

OK, today they're back in Console. I *know* they were not there yesterday. I guess I'll have to chalk up that particular observation to Operator Insanity. In any case, here are those lines from the log, spanning about three days:

com.sophos.intercheck: Corrupt file: /Library/Caches/com.sophos.sau/warehouse/1024
com.sophos.intercheck: Corrupt file: /Library/Caches/com.sophos.sau/warehouse/1168
com.sophos.intercheck: Corrupt file: /Library/Caches/com.sophos.sau/warehouse/1181
com.sophos.intercheck: Corrupt file: /Library/Caches/com.sophos.sau/warehouse/1201
com.sophos.intercheck: Corrupt file: /Library/Caches/com.sophos.sau/warehouse/1260
com.sophos.intercheck: Corrupt file: /Library/Caches/com.sophos.sau/warehouse/1292
com.sophos.intercheck: Corrupt file: /Library/Caches/com.sophos.sau/warehouse/1059
com.sophos.intercheck: Corrupt file: /Library/Caches/com.sophos.sau/warehouse/1068
com.sophos.intercheck: Corrupt file: /Library/Caches/com.sophos.sau/warehouse/1212
com.sophos.intercheck: Corrupt file: /Library/Caches/com.sophos.sau/warehouse/1245
com.sophos.intercheck: Corrupt file: /Library/Caches/com.sophos.sau/warehouse/1304

My cache folders, of course, have reconstituted themselves by now, but none of these files exist in there. And my Sophos and its auto-updating have been working fine for about 20 hours so far, knock on wood.

To recap my problem as best I can remember it: first the Update Now in the shield menu was grayed out; when I then opened Preferences to try to change the update schedule (my way of poking it with a sharp stick) I got a message that the change couldn't be made, making me think it might be a permissions problem; after this the shield icon in the menu bar got an X in it. I tried uninstalling and reinstalling Sophos which did not help, indicating a cache or plist problem in my mind. That's when I looked in the log.

Hope this helps.

I experienced the message that is the topic of this thread about a day ago (5/7/13). I have been running 10.8.3 on a late '09 Mini and installed Office 2011 on 4/27/13 (ca. 11 days ago). My shield has been grayed out.  The console showed the following

system.log
(The following repeated about every minute.)
May  8 22:17:54 macintosh-3 com.apple.kextd[12]: Can't load /Library/Sophos Anti-Virus/InterCheck.app/Contents/Resources/Sophos Anti-Virus.kext - a different version is already loaded.
May  8 22:17:54 macintosh-3 com.apple.launchd[1] (com.sophos.intercheck[14628]): Exited with code: 1
May  8 22:17:54 macintosh-3 com.apple.launchd[1] (com.sophos.intercheck): Throttling respawn: Will start in 10 seconds

Based on the message above, I copied Bob's kext removal command into the console and executed it. The forced restart was apparently not needed, based on the returned message.

The Sophos shield turned black. The preferences show that on-access scanning is on. So this was a fix for me.

However, I downloaded the EICAR file both before and after this fix and got no warning either time.

I'm getting this problem too. The fix suggested worked for me to get it running again but like everyone else I want a lasting fix.

Everything was fine until I visited my girlfriend and, as usual, we were swapping back and forth between users. I wonder whether what has happened is that the process running on one user has begun some kind of update and not finished before the user switch, corrupting the files in the process.

I'm having the same problem.  Apparantly it hasn't been running since last December but the message didn't appear, and the "S" in the shield didn't gray out until yesterday.  I tried scanning manually but it got hung up part way.  I tried resetting everything and that didn't work.  I uninstalled Sophos and reinstalled it and got the same message as soon as the reinstall was finished.  What's going on?

I am having the same problem. Began yesterday getting message that not running. Activity manager does show it was running but icon in menu bar was greyed out (not "X"). Today went into greater detail.

I have not downloaded/updated any software in last week. I am running OS 10.8.3 on a Macbook Pro (2.8 GHz Intel Core 2 Duo).

First error message in console from yesterday 5/8/2013 is:

com.sophos.intercheck: Fatal Error: Unable to initialise virus detection engine [0x00424f70]

com.sophos.intercheck: Sophos Anti-Virus cannot continue
com.sophos.intercheck:
com.sophos.autoupdate: Info: Checked primary server at 11:52 on 08 May 2013
com.sophos.autoupdate: Sophos Anti-Virus was updated
com.sophos.autoupdate:
com.sophos.intercheck: Fatal Error: Unable to initialise virus detection engine [0x00433cb0]
com.sophos.intercheck: Sophos Anti-Virus cannot continue
com.sophos.intercheck:
com.sophos.intercheck: Fatal Error: Unable to initialise virus detection engine [0x0013e020]
com.sophos.intercheck: Sophos Anti-Virus cannot continue
com.sophos.intercheck:
com.sophos.intercheck: Fatal Error: Unable to initialise virus detection engine [0x001246e0]
com.sophos.intercheck: Sophos Anti-Virus cannot continue
com.sophos.intercheck:
com.sophos.intercheck: Fatal Error: Unable to initialise virus detection engine [0x0015e5b0]
com.sophos.intercheck: Sophos Anti-Virus cannot continue
com.sophos.intercheck:
com.sophos.intercheck: Fatal Error: Unable to initialise virus detection engine [0x0011b600]
com.sophos.intercheck: Sophos Anti-Virus cannot continue
com.sophos.intercheck:
com.sophos.intercheck: Fatal Error: Unable to initialise virus detection engine [0x0018b670]
com.sophos.intercheck: Sophos Anti-Virus cannot continue
com.sophos.intercheck:
com.sophos.intercheck: Fatal Error: Unable to initialise virus detection engine [0x0016b3a0]
com.sophos.intercheck: Sophos Anti-Virus cannot continue
com.sophos.intercheck:
com.sophos.intercheck: Fatal Error: Unable to initialise virus detection engine [0x00166050]
com.sophos.intercheck: Sophos Anti-Virus cannot continue
com.sophos.intercheck:
com.sophos.intercheck: Fatal Error: Unable to initialise virus detection engine [0x004599f0]
com.sophos.intercheck: Sophos Anti-Virus cannot continue
com.sophos.intercheck:
com.sophos.intercheck: Fatal Error: Unable to initialise virus detection engine [0x0011fd60]
com.sophos.intercheck: Sophos Anti-Virus cannot continue
com.sophos.intercheck:
com.sophos.intercheck: Fatal Error: Unable to initialise virus detection engine [0x00443320]
com.sophos.intercheck: Sophos Anti-Virus cannot continue
com.sophos.intercheck:
com.sophos.intercheck: Fatal Error: Unable to initialise virus detection engine [0x00194ec0]
com.sophos.intercheck: Sophos Anti-Virus cannot continue
com.sophos.intercheck:
com.sophos.intercheck: Fatal Error: Unable to initialise virus detection engine [0x00183b90]
com.sophos.intercheck: Sophos Anti-Virus cannot continue
com.sophos.intercheck:
com.sophos.intercheck: Fatal Error: Unable to initialise virus detection engine [0x0011a200]
com.sophos.intercheck: Sophos Anti-Virus cannot continue
com.sophos.intercheck:
com.sophos.intercheck: Fatal Error: Unable to initialise virus detection engine [0x0040cbb0]
com.sophos.intercheck: Sophos Anti-Virus cannot continue
com.sophos.intercheck:
com.sophos.autoupdate: Updating catalogue information at 11:55:17 08 May 2013
com.sophos.autoupdate: Catalogue updated at 11:55:17 08 May 2013
com.sophos.autoupdate: Download started at 11:55:17 08 May 2013
com.sophos.intercheck: Fatal Error: Unable to initialise virus detection engine [0x0045ace0]

Error messages continue. I do NOT have any microsoft products on my computer. While I am fairly experienced with the Mac I do not normally go anywhere near the Terminal. 

Should I remove and re download? I have been using since mid-March with no issues before yesterday (verified by checking console). Tried from within program to up - says it is updated.

Thank you for your attention.

Hi Reader951,

Thanks for the note, we have been trying to identify the root cause of the errors "Unable to initialise virus detection engine" but so far haven't been able to (it doesn't happen for us). So I need your help. Could you run the Sophos Diagnostics Utility and send me the output? You can download the SDU from here: 

http://www.sophos.com/en-us/support/knowledgebase/33533.aspx#macgeneral

That tool will collect a lot of information about the current state of your system, and may help us identify the root cause for this baffling problem.