SophosScanD process consuming up to 95% CPU

Question

Dear,

After downgrading my MacBook Pro from Mavericks back to Snow Leopard, I re-installed Sophos Free AV. It seems to work well, except that a SophosScanD process is almost constantly - with short intermittents - using up to 95% (on average, sometimes even more than that) CPU and heating up my machine. I have completely uninstalled and then re-installed the product, from your website, but it keeps happening.

Any ideas? Please let me know if you need more information.

Regards, Hans

This thread was automatically locked due to age.

bobcook · Accepted Answer

Hello everyone,

The root cause of this problem is a defect in the 9.0.11 code that causes SophosScanD to repeatedly restart when the virus detection data package hits its normal end of life warning. This warning is simply that: a warning. Your computer would still be fully protected, but the "useful lifetime" of that product version is reaching its end. You probably noticed the warning is also issued by the on-access scanner (Intercheck) but that component does not contain this same defect thus did not restart itself.

The core detection data hit its end of life warning at midlight last night, and it took a while before we realized what was happening. When we did, we immediately took action to update the Mac software to 9.1.5. This version corrects the bug in SophosScanD, and also contains changes that will ensure timely updates of the core virus detection data without requring a product update. Its important to note that this is the same version that has been available as a preview for a few months now, and its proven very stable.

If you check the version of the software you should see 9.1.5 with threat detection engine 3.51 and threat detection data of 5.05. If you aren't currently seeing that version, run the Update Now command from the shield menu.

We are extremely embarrased about this problem, its highlighted two issues: first, this problem should have been caught during our release planning. There is no excuse to have let this happen. Second, our escalation process for critical issues needs to be reviewed. It shouldn't take a social media storm to get our attention in situations like this. We will do better going forward, and I appreciate your input about our progress. :1019135