07-13-2010, 04:06 PM

Okay, so I installed ClamXav on my MacBook. Norton Anti-Virus scanned it. Then OS X kernel panicked.

When I reviewed the report, I found this:

Backtrace (CPU 0), Frame : Return Address (4 potential args on stack)
0x4718b368 : 0x21b455 (0x5cf328 0x4718b39c 0x2238b1 0x0)
0x4718b3b8 : 0x2a8ab2 (0x591664 0x43ea5d 0xe 0x59182e)
0x4718b498 : 0x29e9a8 (0x4718b4b0 0x0 0x4718b5d8 0x43ea5d)
0x4718b4a8 : 0x43ea5d (0xe 0x48 0x47180070 0x61c0010)
0x4718b5d8 : 0x2f8b47 (0x4718b5fc 0xc75ee00 0x4718b628 0x220570)
0x4718b628 : 0x2fa49d (0x68fc534 0x4718b6b4 0x486d430 0x36)
0x4718b678 : 0x302839dd (0x68fc534 0x4718b6b4 0x486d430 0x0)
0x4718b7a8 : 0x302857a3 (0x4495800 0x10 0x12d2dc 0x0)
0x4718b978 : 0x463978 (0x4392f08 0x0 0x6 0x50a59d4)
0x4718b9b8 : 0x463d9b (0x41d9304 0x4392f08 0x6 0x50a59d4)
0x4718b9f8 : 0x472595 (0x4392f08 0x6 0x50a59d4 0x0)
0x4718bbd8 : 0x4730e5 (0x61c2b7c 0x0 0x0 0x0)
0x4718bf78 : 0x4ed78d (0x5114000 0x6281360 0x62813a4 0x0)
0x4718bfc8 : 0x29eef8 (0x6fe5cc0 0x0 0x10 0x6fe5cc0)
Kernel Extensions in backtrace (with dependencies):
com.symantec.kext.internetSecurity(1.3.1f7)@0x3028 1000->0x3028cfff

I have a feeling I'm going to have uninstall one or the other..but a full explanation on Kext's might further help me understand why my Mac panicked. This is the first time I ever had a KP on a Mac.

I will also mention that I was viewing this thread here on Mac-Forums and clicked on the OP's link to ZDNet. Shortly after visiting that- KP ensued.

So..help?

07-13-2010, 04:50 PM

Never heard of anyone having two anti-virus apps running at the same time on a Mac - that's always been a big no-no even in Windows.

You need to get rid of one or the other - understanding kexts is not going to change that.

From a non-technical perspective (about the only way I understand them), a kext is a kernel extension - typically used for device drivers and other things that modify system files. With two a/v apps you have two items competing with one another to perform almost identical system tasks, take control of and/or modify the same area of the system.

07-13-2010, 05:13 PM

Originally Posted by bobtomay

Never heard of anyone having two anti-virus apps running at the same time on a Mac - that's always been a big no-no even in Windows.

You need to get rid of one or the other - understanding kexts is not going to change that.

From a non-technical perspective (about the only way I understand them), a kext is a kernel extension - typically used for device drivers and other things that modify system files. With two a/v apps you have two items competing with one another to perform almost identical system tasks, take control of and/or modify the same area of the system.

Well..with the way it is now, Norton is set to scan connected storage devices, as well as .dmg's from the internet. It is scheduled to update all definitions for Mac and Windows known malware (etc.), and scan the entire Macintosh HD.

What I will do next is figure out ClamXav and disable Norton.
So far I haven't been able to duplicate the KP, so above is next.

I'll add for my experience (despite it being a no-no in Windows) that I've always used something like MSE or AVG in addition to something like Symantec or McAfee. Never had problems there.

07-13-2010, 05:20 PM

Why do you think you would need to run two antivirus programs?

07-13-2010, 05:40 PM

Originally Posted by schweb

Why do you think you would need to run two antivirus programs?

I was planning on eliminating the other..in the case of my Mac, eliminating Norton, or at the very least, disabling it (but leaving it installed).

In Windows, it's more of an overlap in case that one virus protection software doesn't find a piece of malware that the other does. I'm sort of a security freak when it comes to my computers.

07-13-2010, 07:42 PM

As per Apple's Mac OS X Reference Library, "A kernel extension (or kext) is a dynamically loaded bundle of executable code that runs in kernel space. You can create a kext to perform low-level tasks that cannot be performed in user space. Kexts typically belong to one of three categories: Low-level device drivers, Network filters, File systems." In layman's terms, it's something that has to be done low-level (ie. it has much greater access to the hardware). A driver for something would be lower level than Firefox for example. Some one may be better able to explain this than me - I'm not sure I'm doing that definition justice.

If you are insistent on having AV, get rid of one. There is no need to have both unless you are completely reckless and lack any sense of good judgment when it comes to your usage habits.

07-13-2010, 07:44 PM

I've used both Norton and ClamXav on my Mac. ClamXav runs great, I had some issues with Norton doing weird things at times.

And ClamXav is free, so how can you beat that?

07-13-2010, 10:02 PM

Originally Posted by schweb

I've used both Norton and ClamXav on my Mac. ClamXav runs great, I had some issues with Norton doing weird things at times.

And ClamXav is free, so how can you beat that?

That brings me to this with Norton:

Back in May, I've now had to select my home network from a list, despite Mac OS X being set to join it, and only it, automatically.

Here recently, the Guest account does not work.

And on some occasions, there are other strange things going on in OS X that I can't describe.



So, out with Norton, in with ClamXav.

So one question about Clam. Can it be set to do automatic scanning? Does it automatically and regularly update definitions?

07-14-2010, 07:52 AM

Originally Posted by Chris H.

So one question about Clam. Can it be set to do automatic scanning? Does it automatically and regularly update definitions?

According to their docs, you can have the app auto-update in the "Internet Preferences." You can also set up a schedule if need be. Take a read through that and their other docs.