Sophos Anti-virus

This anti-virus solution is meant for corporates. It includes anti-virus software for all the major OSs, which include all versions of Windows (both server and workstation), various Unices, NetWare, OS/2 and even OpenVMS. We checked out the anti-virus software for Win 2000 networks and another component called the Enterprise Manager, which can deploy and manage anti-virus updates on all workstations on a network. There’s also a MailMonitor component for protecting e-mail servers against viruses, which we didn’t check out. One desirable component we didn’t find in the anti-virus solution was for detecting viruses coming in through HTTP/FTP.

We were impressed by the ease of implementation–from a CD or remotely using the Enterprise Manager option. The Enterprise Manager has an administrative console, the SAVadmin, that shows the status of clients running the anti-virus. It can perform automatic client updates. Normally, the Enterprise Manager tracks new updates from Sophos’ website and downloads them on a preset schedule. However, on the flipside, if the Enterprise Manager goes down, then the update process is very cumbersome. The client’s interface doesn’t have any auto-update option. So you have to download the new virus IDE (identification) files from Sophos’ website, copy them to the Anti-virus client’s installation directory and reboot the system. Thankfully, the IDE files are not very large so they don’t take very long to download.

The client has a very simple and basic interface

The anti-virus desktop client has a simple and easy-to-use interface, though it isn’t very feature-rich. It is however very good at its main job–scanning for viruses. It scans at blazing fast speeds without missing out on any. Another plus is that it can scan and detect viruses even in multi-tiered zip files, meaning a zip file within a zip file. You can configure it to perform various actions such as rename, delete, shred, copy, or move all virus-infected files it finds. One small problem we found is that if it’s scanning a zip file and comes across a virus in the very first file, it stops scanning the remaining files in the archive and immediately does whatever action you’ve configured it for on the zip file. This way other possibly virus infected files in the archive get missed out. Ideally, it should scan every file in the archive and report all infected files so the user can at least extract the non-infected ones. Another problem area is that the default client installation only scans executable files. This way non-executable virus infected files can escape detection. Another feature we missed having was running the anti-virus from a right-click menu. 

The client has an InterCheck Monitor component that sits in the system tray and monitors virus activity in real time. If it finds any virus-like activity or macro viruses, it first tries to disinfect it, or else moves it to a separate folder and informs the user or network manager of the same. It can detect Mac viruses and can also scan incoming mail. The anti-virus package also generates detailed reports of infected files, which can be viewed in an Excel sheet or an ASCII editor. The solution can also be configured to move reports to the central server. 

The Bottom Line Overall, a good anti-virus solution for corporates. 

PCQ Labs