I like new, shiny, wonderful things. The nice folks at Sophos released their latest version of their main antivirus software called, unsurprisingly, Sophos Antivirus!
Sophos Antivirus 6 forms part of a suite of applications now called Sophos Endpoint Security. It includes the Sophos Antivirus software (SAV), as well as a firewall and back-end management software called Enterprise Console, and an update mechanism called Enterprise Library.
SAV has always had excellent virus detection built in. Sophos have developed on this by now including spyware detection and removal, or what they call ‘Potentially Unwanted Applications’ (PUAs). The new moniker for such uninvited malware came due to some litigation by some companies who objected to their software being classed as Spyware. Sophos have played it safe by giving it a somewhat ambiguous name. A wise move perhaps, although it does dilute the meaning of the feature somewhat.
Even so, I recently upgraded an existing installation of Sophos to the newer versions. SAV 6 luckily will upgrade happily from existing SAV 5.5 installs, so it’s an evolutionary process, rather than revolutionary. Having just pushed around SAV 5.x I didn’t relish in having to do it all again for version 6.
I enabled the new PUA support, and did a full scan. I tried it on my PC at work first and found a couple of things; a registry editor tool (a 3rd party freeware tool, part of the BartPE disk), and SuperScan 4. Both are counted as being ‘potentially unwated’ as they can be used to perform malicious tasks. SAV 6 allows you to enter exceptions, so I could pull these apps back out of Quarantine and add them to the ‘allowed’ list, so SAV won’t catch them in future. A nice feature!
This evening I switched on my home PC, and it too upgraded. It found a virus hiding in the system restore folder – quite how they get in there I don’t know – and SuperScan 4. It carried on scanning and then said it found Hotbar! I was shocked and a little surprised, to say the least! On closer inspection, I found it had located it in an installer file for eMule! I was most impressed. Not only can it find running, and installed malware, but also locate it hiding in files ready to be installed! I had experienced a similar response from another installer whilst trying to purposely infect a PC with spyware.
So far, I’m quite impressed. Hopefully it’ll carry on impressing me. Only time will tell, but first impressions are good.