Virex 7.5 #2: Palm Desktop conflict; installation issues; excessive scanning; more

Yesterday we began coverage of the latest version of Virex, 7.5, provided free to members of Apple's .Mac service and available for retail purchase. We focused primarily of reports of a longstanding problem where Virex can delete email mailboxes if it finds "infected" messages in the mailboxes; however, a number of other issues have also been reported. We continue coverage of these issues today.

Palm Desktop HotSync conflicts Several readers have reported problems using the HotSync function of Palm Desktop after installing Virex. For Bob Kinsman, the issue is a general "connection lost" error:

"After installing Virex 7.5, I found that my Palm HotSync process would crash in mid-sync. The Conduit Manager would start the HotSync process normally, but about halfway through the process, the Conduit Manager would quit from the Mac desktop. Strangely enough, the HotSync continues on the Palm device for another 20-30 seconds (it says it's syncing the Memo Pad), then aborts with this message: The connection between your handheld computer and the desktop was lost. Some of your data was NOT backed up. Please check your setup and try again. Attempting another HotSync yields only frustration.

"However, there just happens to be a simple solution to this problem: Open Virex 7.5, open the Preferences panel, un-check 'Active Virus Detection,' then HotSync to your heart's content. The problem is gone. The nice thing is that you don't even have to close the Virex preference pane, since the 'uncheck' change takes place immediately. After the HotSync is complete, re-check 'Active Virus Detection' again, and you're back in business...or at least until the next HotSync is required."

Paul Christensen's report is similar to the "file locked" error we previously covered with Palm Desktop, independent of Virex:

"I've been using PalmDesktop 4.2.x on MacOS 10.3.x successfully with no problems until yesterday, after I installed Virex 7.5. Now, I have had 3 times where HotSync immediately fails with a 'File Locked' error that others have mentioned. When this error first occurred, I restarted only to get the same problem. This morning, I received the same error, but a subsequent HotSync (after half an hour of Web surfing) was finally successful. I suspect (but have been unable to verify) that Virex is attempting to background scan a critical Palm file, and this is causing the file lock failure. Next time this error occurs, I'll use Activity Monitor to see if Virex has opened a critical file."

Workarounds for avoiding email deletion Reader Michael Davis offers suggestions for avoiding the serious issue where Virex may delete "infected" mailboxes; his procedure refers to a different anti-virus utility, but the concept is the same:

I have not yet had the opportunity to try Virex v7.5, as we are awaiting the installer's roll-out on the university's official download page for site-licensed software. I do know that NAI's VirusScan for Windows can run into a similar issue with regard to wiping out mailboxes. The VirusScan installer(s) available from the university were recently modified to accommodate this issue with respect to Eudora. The workaround is to define one or more 'exclusions' in VirusScan's on-access scanner. An exclusion is generally created by defining a path (absolute or relative) along which VirusScan should skip its processing. In the case of Eudora for Windows, the most general exclusion is usually defined as the relative path "Eudoraspool" with scanning (also) disabled for subfolders of this path. As a safety net, I also define '*.mbx' as a file-based exclusion on my own Windows systems. If Virex v7.5 doesn't already have a mechanism for defining exclusions, I believe it would be in NAI's best interests to implement this feature in a future version of Virex ASAP, if for no other reason than to claim better 'feature parity' with VirusScan for Windows."

We should note that using such an "exclusion" on your email mailboxes means that incoming email will not be scanned for viruses -- generally the main source of such malicious files.

Can't install because of "anti-virus" software Yesterday we covered reports of an inability to install Virex 7.5 because the installer claims that other anti-virus software is installed. Messages on Apple's Discussions forums indicated that the cause of the problem is the folder /Library/Startup/Norton MissedTasks. Reader Louie Berry confirms this issue:

"Although I had no anti-virus app installed except Virex 7.2, the installer balked on OS 10.2.8 and OS 10.3.5 volumes saying that I did (as others have now reported). After lots of experimenting I discovered that the 'NortonMissedTasks' folder at Library/StartupItems was the show stopper. In my case that folder was installed as part of Norton Utilities. I suspect that NAV must install a folder/file with the same title. I found two ways around this: (1) booting into the Safe Mode, installing Virex and then rebooting normally; or (2) removing the Norton folder, installing Virex and then adding the Norton folder back."

Excessive scanning Both the MacFixIt inbox and the online comments to yesterday's article have been filled with reports of Virex 7.5 consuming an excessive proportion of processor cycles when scanning (and such scanning is constant for many users). For example, Steve Englehart writes:

"I, too, had the 'Virex can't install' problem. Being bullheaded, I did a safe start and installed it that way. When I checked email afterward, I (fortunately!!) did not lose any mailboxes, but Virex announced it had found an infected file named 'important.scr,' way down in '.vol.' The problem was, it kept finding it, every 30 seconds thereafter. I couldn't delete it, ignore it, or send it to trash, so I finally had to turn off active and background scanning."

Not "catching" virus files? Reader Ned Snowing reports another serious issue with Virex 7.5: an inability to identify virus files:

"After installation I tried to test it using the suggested EICAR test files. On the first file everything went fine, it identified the 'virus' and notified me (I had Virex set to only notify me of viruses) as expected. Although that's where things ended. On each of the following files Virex failed to detect a virus. As it turns out Virex would only identify the first virus it encountered with every subsequent virus being passed unnoticed until you restarted, after which I got only one virus identified again."

If you've installed Virex 7.5, drop us an email with your experiences at Late-breakers@macfixit.com.

Resources