This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Latest pre-release of 10.11.4 breaks Sophos AV Home Edition

The problem that existed prior to the release of 9.4.1 is back with the latest version of El Capitan that has just been pre-released 10.11.4 Beta (15E27e). The Sophos icon remains dimmed in the menu bar with the error On-Access Scanning Is Disabled. Could someone in engineering please take a look at this?



This thread was automatically locked due to age.
Parents Reply
  • ZRL1, good detective work! This did, in fact, solve the problem, or as you note, allow SAV Home to run until Sophos can figure out how to fix this correctly without having to compromise my Mac's security.

    How did you figure out that it was SIP that was causing the problem? It's a little puzzling that it's the problem since, as noted by VincentCina, SIP has been running in El Capitan since it was released.
Children
  • bocaboy said:
    ...How did you figure out that it was SIP that was causing the problem? It's a little puzzling that it's the problem since, as noted by VincentCina, SIP has been running in El Capitan since it was released.

    When El Cap was first introduced, SIP was the new security feature and it got enough coverage that some discussions included the Terminal commands to control it. After my original upgrade to El Cap, Sophos stopped working so turning off SIP seemed worth a try and it worked. As Sophos improved, I'd turn SIP on again as a test and left it on when the problem was solved. But when the problem recurred, turning SIP off was worth a try again, especially since it's simple enough to do. But since SIP is a good idea for security, the csrutil fix should be temporary at best if the betas are on a production machine. 

  • Thanks for the explanation. I had the same problem as I described here when I installed SAV under Yosemite on my iMac. (Inexplicably, my MacBook Pro was fine under the same OS. Go figure) Anyway, the problem with SAV resolved itself when 9.4.1 was released. It's also been working fine all the way to this beta of 10.11.4. In other words, SIP was never an issue prior to this beta.

    Anyway, I did disable SIP, and that solved the problem of the dimmed icon. I have no idea if the problem is with Apple or Sophos, but I've reported it as a bug on the Developer forum at Apple as well as via Feedback Assistant. We'll see if that changes anything.

    For the record, I'm surprised that Sophos QA doesn't uncover these problems. They have access to the same builds we do, and based on how many people experience issues, how is it that they're not uncovered prior to release? I'll give them a buy on 10.11.4 as it was just released last week, but this problem has existed on previous builds as well. Anyway, not trying to be difficult, just questioning the QA process at Sophos and that maybe it should be re-examined.