SophosAV post-install issues

[#1]

When a new user logs in to a system (10.6.3) that is freshly imaged, they're being presented with a window asking for the location of "System Events". This seems to be related to SophosAV.

I know several people on this list are using Sophos, and I was wondering if you're seeing the same thing, and if so, how did/do you get around it?

Thanks,

P

[talkingmoose]

This sounds like an AppleScript that is trying to call "System Events". If
On 4/20/10 10:31 AM, "Wann, Peter" <p.wann at tcu.edu> wrote:
the script was compiled on an earlier version of Mac OS than where it's
running, you may need to open it on a newer system and resave to update its
pointer.

--

William Smith
Technical Analyst
Merrill Communications LLC
(651) 632-1492

[jmclaughlin]

I am also getting this but haven't found a way around it. Are you sure
it's connected to Sophos?

John McLaughlin
Technical Support Specialist
Newton Public Schools

[#4]

We are also getting that. We did not get the error until we added Sophos
to the configuration. The Sophos package was made on a machine running
10.6.2 and we incur the error on the 10.6.2 machines. Just canceling out of
it makes it go away and it will not recur for that user and so far we are
not seeing a problem with Sophos updating or anything else in the system but
I'm still a little wary.

Emilia

-- Emilia Treglia
Technology Support Specialist
Scotch Plains Fanwood Schools
667 Westfield Road
Scotch Plains, NJ 07076

908-889-8600 x433

[pbenham]

Hi,

I have been seeing this same behavior on my 10.6.3 images. I have done some sleuthing and have found that a couple of files are modified if you follow the window's instructions and browse for System Events and select it. The two files are /Users/user/Library/Preferences/com.apple.applescript.plist and /Users/user/Library/Preferences/com.sophos.ui.plist.

I'm not sure if they are both relevant to this issue, butI packaged them up with Composer and added them to a test image so that they filled the user template. So far it seems to have fixed the issue (in my limited testing), although it would be nice to know why it's doing it in the first place.

[ernstcs]

I suggested to Peter when he originally posted to use the MPKG that the Sophos server creates for you as a post-imaging install. I’ve never seen these issues.

Basically I have a policy that’s triggered manually to install the ‘Sophos Anti-Virus.mpkg’ that gets installed on your Sophos server distribution point. I have a script that runs at reboot that triggers the policy to install. The MPKG has to be installed on the live partition of the system and not during the Casper Imaging phase.

I update the package in my JSS occasionally. I also find it handy to dig into the MPKG and pull out out the ‘Remove Sophos Anti-Virus.pkg’ and have that in the JSS as well. It’s handy when a system flips out and bombards me with alerts when it got stuck on something and a reboot of the system doesn’t correct it. Do a remote uninstall and reinstall...voila.

No packaging required, it’s done for you. The MPKG does have the configuration information for your update point and server as well. It just works.

Note: DO NOT rename the MPKG or PKG files or they won’t work.

Cheers,

Craig E

[#7]

I am working with Sophos on this problem. For the people that are interested, here was their most recent response:

The error you are seeing is not a Sophos error, rather its an error for the loading of /Library/ScriptingAdditions/Adobe Unit Types.osax.

The issue is around the fact that the OS doesnt know whether the program or application starting up will require certain OSA additions. So it attempts to load all OSA additions first. If it fails you get an error message, like this one, but it gets reported against the application which was originally trying to load.

This can normally be fixed by repairing permissions against the OSA addition in question.
So there are two things to try.

1. Open up Disk Utility and "Verify Disk Permissions". If there are problems, then "Repair Disk Permissions".
2. If the above doesnt work, then you could try changing the permissions of /Library/ScriptingAdditions/Adobe Unit Types.osax directly, by opening Terminal and running this command as root:

chmod -R 755 /Library/ScriptingAdditions/Adobe Unit Types.osax

Those suggestions did not fix the problem. However, it is related to the Adobe Unit Types.osax file. If you remove that file, the error will no longer appear. But that is not a solution for us. I am still working with them on a viable solution.

Travis

[John_Wetter]

We’ve also seen this. Has anyone talked to Sophos support? We’re using the Sophos provided installer so all of the postflights happen to contact the Sophos enterprise console. We also are now seeing that we can’t run this during the imaging, it has to be run at reboot.

John

--
John Wetter
Technical Services Manager
Educational Technology, Media & Information Services
Hopkins Public Schools
952-988-5373

[John_Wetter]

Note to self: Read the entire list before replying....

Travis, thanks for looking into that! If you get the ‘we haven’t heard about this issue from anyone else’ response, let us know so we can all call them! On most of the machines we’re getting this error on, the only adobe product on them is Adobe reader.

John

[pbenham]

Just to clarify that we can replicate this error with a plain vanilla image of 10.6.3 with the only addition being Sophos 7.1.6 and Mobile account users (the error does not seem to appear if a new local user is created).

paul

[#11]

Craig,
What does your script look like that runs at reboot that triggers the policy to install?
Becky

[ernstcs]

Attached is the screen of the policy trigger, and the script text is below. The script in the JSS is part of all my configurations and runs ‘At Reboot’

#!/bin/sh

. /etc/rc.common

## Install Sophos Anti-Virus as part of FirstRun
/usr/sbin/jamf policy -trigger installSophosAfter

[ernstcs]

Hi Travis,

I am wondering if there has been any other movement on this topic?

Thanks,

Craig E

[#14]

Sophos seems somewhat slow with resolving this. The last correspondence I had with them (about two weeks ago) was this:

Hello Travis,

Can you please supply us with a sample of the following file:

/Library/ScriptingAdditions/Adobe Unit Types.osax

This case has been escalated to our Global team for review, the above file is necessary for replication of the issue and is required in order to proceed.

--missing content--

ssue. Yes, we are calling into System Events. If System Events is parsing /
Library/ScriptingAdditions/ and has an issue on this Adobe file, then that is an Adobe issue, regardless if we are triggering it or not. Either way, i
f i can replicate this in house then it is possible we can raise a call wit
h Adobe on the issue.

--missing content--

ssue. Yes, we are calling into System Events. If System Events is parsing /
Library/ScriptingAdditions/ and has an issue on this Adobe file, then that is an Adobe issue, regardless if we are triggering it or not. Either way, i
f i can replicate this in house then it is possible we can raise a call wit
h Adobe on the issue.<br>
</font><font face"Lucida Grande"><br>

[ernstcs]

I will see if I can replicate this and submit it from my end as well.

Thanks for the update!

Craig E

--missing content--

ssue. Yes, we are calling into System Events. If System Events is parsing /
Library/ScriptingAdditions/ and has an issue on this Adobe file, then that is an Adobe issue, regardless if we are triggering it or not. Either way, i
f i can replicate this in house then it is possible we can raise a call wit
h Adobe on the issue.

--missing content--

ssue. Yes, we are calling into System Events. If System Events is parsing /
Library/ScriptingAdditions/ and has an issue on this Adobe file, then that is an Adobe issue, regardless if we are triggering it or not. Either way, i
f i can replicate this in house then it is possible we can raise a call wit
h Adobe on the issue.<br>
</font><font face"Lucida Grande"><br>

[pbenham]

Hi,

in my testing this issue occurred when there wasn't and Adobe Unit Type.osax files on the system.

paul

[RobertHammen]

I was having some other issue with being able to get some info from Casper, and JAMF tech support pointed me to Adobe Unit Types.osax (as well as QuarkXPress Scripting Addition, not the exact filename). Removing those fixed the problems. Turned out the Adobe Unit Types.osax for CS4 isn't 64-bit and caused issues on Snow Leopard - there was an updated one, not listed on Adobe's update site, but in their KB - http://kb2.adobe.com/cps/516/cpsid_51615.html
On Jun 1, 2010, at 9:54 AM, Ernst, Craig S. wrote:

That fixed the issue (scoped to clients who had CS4 and were running under Snow Leopard). If you have any other third party scripting additions, try removing them and seeing if that fixes/resolves your issue...

--Robert