Sophos Anti-Virus for Mac OS X User Manual

User manual
Sophos Anti-Virus for Mac OS X, version 4.8
For networked and single computers running Mac OS X 10.2 or later
Document date: May 2006
About this manual
This user manual explains how to use Sophos Anti-Virus for Mac OS X,
and how to configure
• virus scanning
• virus alerts
• disinfection
• reporting
• notification
• logging
• updating.
The manual also provides help in resolving common problems.
If you are using Mac OS 8 or 9, refer instead to the Sophos Anti-Virus Mac
OS 8 or 9 user manual.
Sophos documentation is published at www.sophos.com/support/docs/
and on the Sophos CDs.
Copyright 2004–2006 Sophos Group. All rights reserved. No part of this
publication may be reproduced, stored in a retrieval system, or transmitted, in any
form or by any means, electronic, mechanical, photocopying, recording or
otherwise unless you are either a valid licensee where the documentation can be
reproduced in accordance with the licence terms or you otherwise have the prior
permission in writing of the copyright owner.
Sophos and Sophos Anti-Virus are registered trademarks of Sophos Plc and
Sophos Group. All other product and company names mentioned are trademarks
or registered trademarks of their respective owners.
Sophos Anti−Virus for Mac OS X
Contents
About Sophos Anti−Virus.....................................................................................1
Sophos Anti−Virus window...........................................................................1
Sophos Anti−Virus icon.................................................................................3
Using Sophos Anti−Virus.....................................................................................4
How to run an immediate scan.....................................................................4
How to change items for scanning................................................................5
How to see the results of a scan...................................................................6
How to start and stop on−access scanning..................................................6
Setting preferences...............................................................................................8
How to open the preferences pages.............................................................8
How to edit which file types Sophos Anti−Virus scans..................................9
How to edit exclusion preferences..............................................................11
How to edit disinfection preferences...........................................................13
How to edit reporting preferences...............................................................15
How to edit desktop alerts preferences.......................................................16
How to edit email notification preferences..................................................18
How to edit logging preferences.................................................................20
How to restore the default preferences.......................................................22
Finding virus information...................................................................................24
How to find out about a virus via the Sophos Anti−Virus window...............24
How to find out about a virus via the on−screen log...................................24
How to find out about a virus via the web...................................................25
Disinfection..........................................................................................................26
How to set up automatic disinfection..........................................................26
How to carry out manual disinfection..........................................................28
Updating Sophos Anti−Virus..............................................................................29
How to update manually.............................................................................29
How to set up automatic updating...............................................................30
How to set a source for updates.................................................................31
How to set an alternative source for updates..............................................33
How to schedule updates............................................................................34
How to update via a proxy..........................................................................35
How to check the progress of an update....................................................36
How to receive desktop alerts about updates.............................................37
How to log updates.....................................................................................38
Troubleshooting..................................................................................................40
Sophos Anti−Virus icon has a white cross..................................................40
Sophos Anti−Virus icon is greyed out.........................................................40
Updating fails to happen.............................................................................40
Sophos Anti−Virus for Mac OS X
Using Sophos Anti−Virus via Terminal
Contents
Troubleshooting
Document not disinfected...........................................................................41
Virus fragment reported..............................................................................42
Sophos Anti−Virus reports errors................................................................42
Getting further help.....................................................................................43
Using Sophos Anti−Virus via Terminal.............................................................44
About Sophos Anti−Virus
Sophos Anti−Virus is software that detects viruses, worms and trojans on your
computer or network. It can also disinfect infected items. In particular, it can
• scan your computer or network for viruses
• check each file you access for viruses
• eliminate viruses
• alert you when it finds a virus
• keep a log of its activity
• be updated to detect the latest viruses.
Sophos Anti−Virus consists of two main components:
• the Sophos Anti−Virus window
• the Sophos Anti−Virus icon.
Sophos Anti−Virus window
To open the Sophos Anti−Virus window, in a Finder window, click Applications.
Find and double−click Sophos Anti−Virus.
The components of the window are described in the following sections.
1
Sophos Anti−Virus for Mac OS X
About Sophos Anti−Virus
• Button bar
• Scan list
• On−screen log.
To close the Sophos Anti−Virus window, on the Sophos Anti−Virus menu, click
Quit Sophos Anti−Virus.
Button bar
In the Sophos Anti−Virus window, the buttons are shortcuts to commonly−used
menu options.
The button shown below starts scanning.
The button shown below stops scanning.
The button shown below opens a dialog box in which you can configure scanning.
The button shown below connects you to virus analyses on the Sophos website.
The button shown below opens the help system.
Scan list
In the Sophos Anti−Virus window, the scan list shows the drives, paths and files
that can be scanned.
2
Sophos Anti−Virus for Mac OS X
About Sophos Anti−Virus
On−screen log
In the Sophos Anti−Virus window, the on−screen log contains all messages
logged since the window was opened.
The information is also added to the continuous log (see Logging preferences for
immediate scanning).
Sophos Anti−Virus icon
The Sophos Anti−Virus icon is displayed in the system status bar, even if the
Sophos Anti−Virus window is closed. The appearance of the icon changes
depending on whether on−access scanning is active, whether Sophos Anti−Virus
is updating and whether Sophos Anti−Virus updated successfully last time. While
on−access scanning is active, the icon is blue.
If you pass the mouse over the icon, the tool tip displays the status of updating.
If you click the icon, a menu is displayed. From here, you can
• update Sophos Anti−Virus
• check the progress of an update
• open the Sophos Anti−Virus window
• configure on−access scanning, notification and updating
• check the Sophos Anti−Virus version information.
To prevent display of the Sophos Anti−Virus icon, open the Sophos
Anti−Virus preferences pages (see How to open the preferences
pages). Click the padlock icon and enter your username and
password, so that you can make changes. At the top of the Scanning
tabbed page, on the pop−up menu, choose General. Deselect Show
Sophos Anti−Virus icon in system status bar.
3
Using Sophos Anti−Virus
This section describes how to
• run an immediate scan
• change items for scanning
• see the results of a scan
• start and stop on−access scanning.
How to run an immediate scan
An immediate scan is a virus scan of the computer, or parts of the
computer, that you can carry out at any time.
You run an immediate scan from the Sophos Anti−Virus window.
The scan list shows items that can be included in scans. An indicator light to the
left of an item indicates whether it is activated and will be scanned. Click the light
to activate or deactivate items.
Scanning all selected items
To scan all the items selected for scanning in the scan list, click the button shown
below.
4
Sophos Anti−Virus for Mac OS X
Using Sophos Anti−Virus
Drag and Drop scanning
To scan an item without adding it to the scan list, drag it from a Finder window
onto the button shown below.
Individual item scanning
To scan an individual item in the scan list, double−click the item. (It need not be
highlighted, nor does the indicator light to the left of the item need to be
illuminated.).
Cancelling scanning
To cancel scanning, click the button shown below.
How to change items for scanning
You change items for immediate scanning from the Sophos Anti−Virus window.
By default, all local hard drives and network volumes are included in the scan list,
and are activated for scanning. You can change the items in the scan list as
described below.
5
Sophos Anti−Virus for Mac OS X
Using Sophos Anti−Virus
To add a disk, folder or file to the scan list, drag it from a Finder window into the
scan list. Drag and Drop is the only way to add an individual file.
To scan an item without adding it to the scan list, drag it from a Finder
window onto the button shown below.
To remove an item from the scan list, drag it to the Trash can.
How to see the results of a scan
You can see the results of a scan in the Sophos Anti−Virus window.
Click the Details selector arrow in the bottom left of the window. This displays the
on−screen log, which shows all scans performed, viruses found and errors
encountered during the current session.
This information is also added to the continuous log (see How to edit
logging preferences).
To clear the on−screen log, click Clear Log.
If Sophos Anti−Virus reports a virus and you want information about it,
double−click the line of text that contains the name of the virus. This takes you to
specific information about the virus on the Sophos website (see Finding virus
information).
How to start and stop on−access scanning
On−access scanning intercepts files as they are accessed, and grants
access to only those that are virus free.
If you installed on−access scanning as part of Sophos Anti−Virus, on−access
scanning starts automatically when you start the computer. You can
• check whether on−access scanning is running
• start and stop on−access scanning.
To check whether on−access scanning is running
In the system status bar, look for the Sophos Anti−Virus icon. If on−access
6
Sophos Anti−Virus for Mac OS X
Using Sophos Anti−Virus
scanning is running, the icon is blue. If it is not running, the icon is greyed out.
To start and stop on−access scanning
On the Apple menu, choose System Preferences. In the Other section of the
System Preferences window, find the Sophos Anti−Virus icon and click it.
Alternatively, in the system status bar, click the Sophos Anti−Virus icon to
display a menu. Choose Open Preferences.
In the Sophos Anti−Virus preferences pages, click the padlock icon and enter your
username and password, so that you can make changes.
At the top of the Scanning tabbed page, on the pop−up menu, choose General.
To start scanning, click Start. To stop scanning, click Stop.
7
Setting preferences
This section describes how to set your preferences for
• scanning
• exclusions
• disinfection
• reporting
• desktop alerts
• email notification
• logging.
It also describes how to restore default settings.
How to open the preferences pages
Sophos Anti−Virus has two sets of preferences pages: one for immediate
scanning and one for on−access scanning, notification and updating.
To view the pages for immediate scanning
Open the Sophos Anti−Virus window. Click the button shown below.
This returns you to the preferences page you last accessed.
Each user on the computer can set different preferences for immediate
scanning.
To view the pages for on−access scanning, notification and
updating
On the Apple menu, choose System Preferences. In the Other section of the
System Preferences window, find the Sophos Anti−Virus icon and click it.
Alternatively, in the system status bar, click the Sophos Anti−Virus icon to
display a menu. Choose Open Preferences.
8
Sophos Anti−Virus for Mac OS X
Setting preferences
The Sophos Anti−Virus preferences pages are displayed. Click the padlock icon
and enter your username and password, so that you can make changes.
When you have finished making changes in the preferences pages, click the Set
button to put them into effect.
How to edit which file types Sophos Anti−Virus
scans
You set preferences separately for immediate and on−access scanning.
Scanning preferences for immediate scanning
Open the Immediate Scanning Preferences window (see How to open the
preferences pages). On the Immediate Scan menu, choose Scanning Options.
Scan inside archive and compressed files
Select this to enable Sophos Anti−Virus to scan inside archive and compressed
files.
Scan mailboxes
Select this to enable Sophos Anti−Virus to scan emails and attachments in
Outlook Express mailboxes.
9
Sophos Anti−Virus for Mac OS X
Setting preferences
Include non−Macintosh virus detection
Select this to enable Sophos Anti−Virus to detect non−Mac viruses, as well as
Mac and document viruses. Note that non−Mac viruses cannot infect Macs but
can infect any non−Mac computers on the network.
Scanning preferences for on−access scanning
Open the Sophos Anti−Virus preferences pages (see How to open the
preferences pages). Click the padlock icon and enter your username and
password, so that you can make changes.
At the top of the Scanning tabbed page, on the pop−up menu, choose Scanning
Options. Change the settings (described below) and then click Set to put them
into effect.
Detect non−Macintosh viruses
Select this to enable Sophos Anti−Virus to detect non−Mac viruses, as well as
Mac and document viruses. Note that non−Mac viruses cannot infect Macs but
can infect any non−Mac computers on the network.
10
Sophos Anti−Virus for Mac OS X
Setting preferences
Scan network volumes
Select this to enable Sophos Anti−Virus to scan files that you access on network
volumes.
Scan inside archive and compressed files
Select this to enable Sophos Anti−Virus to scan inside archive and compressed
files.
How to edit exclusion preferences
You can exclude files, folders and volumes from on−access scanning.
Open the Sophos Anti−Virus preferences pages (see How to open the
preferences pages). Click the padlock icon and enter your username and
password, so that you can make changes.
At the top of the Scanning tabbed page, on the pop−up menu, choose
Exclusions. Add, edit or remove exclusions (described below) and then click Set
to put the settings into effect.
11
Sophos Anti−Virus for Mac OS X
Setting preferences
Adding an exclusion
You can add an exclusion in one of the following ways:
• Drag and drop the item onto the list of excluded items.
• Click Choose and choose the item from the picker.
• Click an item in the list of excluded items, click the + button and edit the
new item. To find out how to specify which items are excluded, see
Exclusion rules.
Editing an exclusion
Double−click an item in the list of excluded items and edit the item. To find out
how to specify which items are excluded, see Exclusion rules. You must then click
elsewhere in the list of excluded items to enable the Set button.
Removing an exclusion
Click the item in the list of excluded items and click the − button.
Exclusion rules
You may enter any POSIX path, whether it is a volume, folder or file. Although
wildcard characters are not supported, you can specify which items are excluded
using the following rules.
• To exclude a folder and sub−folders recursively, suffix the exclusion with a
slash.
• To exclude a folder but not sub−folders, suffix the exclusion with a double
slash.
• To exclude a file, do not suffix the exclusion with a slash or double slash.
• To exclude a folder or file in a specific location, prefix the exclusion with a
slash.
• To exclude a folder or file anywhere locally or on the network, do not prefix
the exclusion with a slash.
Examples
/MyFolder/MyApplication
excludes the file MyApplication in a specific location.
/MyFolder/
excludes all files in the folder MyFolder in a specific location and sub−folders
recursively.
12
Sophos Anti−Virus for Mac OS X
Setting preferences
/MyFolder//
excludes all files in the folder MyFolder in a specific location but not sub−folders.
MyFolder/MyApplication
excludes the file MyApplication in any folder that is called MyFolder, locally or on
the network.
MyFolder/
excludes all files in any folder that is called MyFolder, locally or on the network,
and sub−folders recursively.
MyFolder//
excludes all files in any folder that is called MyFolder, locally or on the network,
but not sub−folders.
MyApplication
excludes the file MyApplication anywhere locally or on the network.
How to edit disinfection preferences
You set disinfection preferences separately for immediate and on−access
scanning.
Disinfection preferences for immediate scanning
Open the Immediate Scanning Preferences window (see How to open the
preferences pages). On the Immediate Scan menu, choose Disinfection.
13
Sophos Anti−Virus for Mac OS X
Setting preferences
Enable Disinfection
Select this to enable automatic disinfection of infected documents or program files
found during scanning.
Confirm Disinfection
Select this to ensure Sophos Anti−Virus prompts for confirmation before it
attempts disinfection.
Action On Infected Files
Select this to specify the action taken against infected files if you are not using
automatic disinfection, or if disinfection fails. Sophos Anti−Virus can delete a file,
move it to prevent it being run, or copy it to a specified folder for further analysis.
Click Select to specify the folder where infected files are placed.
Disinfection preferences for on−access scanning
Open the Sophos Anti−Virus preferences pages (see How to open the
preferences pages). Click the padlock icon and enter your username and
password, so that you can make changes.
At the top of the Scanning tabbed page, on the pop−up menu, choose
Disinfection. Change the settings (described below) and then click Set to put
them into effect.
14
Sophos Anti−Virus for Mac OS X
Setting preferences
Enable disinfection
Select this to enable automatic disinfection of infected documents or program files
found during scanning.
Action on infected files
Select this to specify the action taken against infected files if you are not using
automatic disinfection, or if disinfection fails. Sophos Anti−Virus can delete a file,
move it to prevent it being run, or copy it to a specified folder for further analysis.
Click Select to specify the folder where infected files are placed.
How to edit reporting preferences
Reporting preferences are available for immediate scanning only.
Open the Immediate Scanning Preferences window (see How to open the
preferences pages). On the Immediate Scan menu, choose Reporting.
Sophos Anti−Virus also maintains a continuous log of all scanning activity.
See How to edit logging preferences.
15
Sophos Anti−Virus for Mac OS X
Setting preferences
Enable reporting
Select this to enable Sophos Anti−Virus to generate a report file each time an
immediate scan is run.
List infected files only
By default, Sophos Anti−Virus reports infected files only. Deselect this option to
enable Sophos Anti−Virus to report all files scanned.
Report Filename
You can enter a report filename in this text box. The default name is 'SAV Report'.
Note that this file is overwritten each time a scan is run, unless a new filename is
chosen for each report.
Click Select to specify where the report file is stored. The default is the desktop of
the user who is running Sophos Anti−Virus.
Click Editor to choose the text editor with which the report file can be opened.
The default is TextEdit.
How to edit desktop alerts preferences
You set desktop alerts preferences separately for immediate and on−access
scanning.
16
Sophos Anti−Virus for Mac OS X
Setting preferences
Alerts sent by immediate scanning
Open the Immediate Scanning Preferences window (see How to open the
preferences pages). On the Immediate Scan menu, choose Desktop alerts.
Enable Desktop alerts
Select this to enable Sophos Anti−Virus to display alerts in a pop−up box at the
end of each immediate scan. There are two levels of alerting:
If you click Viruses, Sophos Anti−Virus will warn you if it finds a virus.
If you click Viruses and Errors, it will display both virus warnings and error
messages.
User−defined pop−up message
In this text area, you can specify the text of the pop−up that will be displayed
when Sophos Anti−Virus encounters viruses or errors.
Alerts sent by on−access scanning
Open the Sophos Anti−Virus preferences pages (see How to open the
preferences pages). Click the padlock icon and enter your username and
password, so that you can make changes.
At the top of the Scanning tabbed page, on the pop−up menu, choose Desktop
Alerts. Change the settings (described below) and then click Set to put them into
effect.
17
Sophos Anti−Virus for Mac OS X
Setting preferences
Enable desktop alerts
Select this to enable Sophos Anti−Virus to display alerts in a pop−up box. There
are two levels of alerting:
If you click Viruses, Sophos Anti−Virus will warn you if it finds a virus.
If you click Viruses and errors, it will display both virus warnings and error
messages.
User−defined pop−up message
In this text area, you can specify the text of the pop−up that will be displayed
when Sophos Anti−Virus encounters viruses or errors.
How to edit email notification preferences
Macs can send virus reports for immediate and on−access scanning to an email
address.
Open the Sophos Anti−Virus preferences pages (see How to open the
preferences pages). Click the padlock icon and enter your username and
password, so that you can make changes.
18
Sophos Anti−Virus for Mac OS X
Setting preferences
In the Notification tabbed page, change the settings (described below) and then
click Set to put them into effect.
Enable immediate scanner email notification
Select this to enable Sophos Anti−Virus to send virus reports during immediate
scanning.
Enable on−access scanner email notification
Select this to enable Sophos Anti−Virus to send virus reports during on−access
scanning.
Recipient
In this text box, type the email address of the recipient of the virus reports.
Sender
In this text box, type the email address of the sender of the virus reports.
Outgoing mail server
In this text box, type the address of the server that sends the virus reports.
19
Sophos Anti−Virus for Mac OS X
Setting preferences
Port
In this text box, type the port on the Mac that is used to send virus reports.
Viruses
Select this to enable Sophos Anti−Virus to send virus reports if it finds a virus.
Viruses and errors
Select this to enable Sophos Anti−Virus to send virus reports if it finds a virus or
there is an error.
How to edit logging preferences
You set preferences separately for immediate and on−access scanning.
Logging preferences for immediate scanning
Sophos Anti−Virus maintains a continuous log of all immediate scanning activity,
including viruses found, which is written to a log file on disk.
To configure this file, open the Immediate Scanning Preferences window (see
How to open the preferences pages). On the Immediate Scan menu, choose Log
File. By default the log is a file called "Sophos Anti−Virus Log.rtf".
The log file cannot be disabled.
20
Sophos Anti−Virus for Mac OS X
Setting preferences
Location of the Sophos Anti−Virus Log file
Click Select to specify a folder for the log file. By default, it is placed on the
desktop of the user who is running Sophos Anti−Virus.
Click Editor to choose the editor in which you will view the log file. The default is
TextEdit.
Click Purge Log File to purge the contents of the log file.
Logging preferences for on−access scanning
Open the Sophos Anti−Virus preferences pages (see How to open the
preferences pages). Click the padlock icon and enter your username and
password, so that you can make changes.
At the top of the Scanning tabbed page, on the pop−up menu, choose Logging.
Change the settings (described below) and then click Set to put them into effect.
Logging into system log
Select this to enable Sophos Anti−Virus to log all on−access scanning activity,
including viruses found, in the system log.
21
Sophos Anti−Virus for Mac OS X
Setting preferences
Logging into a file
Select this to enable Sophos Anti−Virus to log all on−access scanning activity,
including viruses found, in a log file on disk.
Click Select to specify the folder for the log file. The default is the Logs folder.
In the File name text box, type the log file name. The default is "Sophos
Anti−Virus Log.txt".
Click View Log File to view the log file in a separate window. Click Purge Log
File to purge the contents of the log file.
How to restore the default preferences
Immediate scanning
To restore the default preferences for immediate scanning, on the Special menu,
choose Restore Defaults.
On−access scanning, notification and updating
To restore the default preferences for on−access scanning, notification and
updating, open the Sophos Anti−Virus preferences pages (see How to open the
preferences pages). Click the padlock icon and enter your username and
password, so that you can make changes.
Click Defaults.
22
Sophos Anti−Virus for Mac OS X
Setting preferences
23
Finding virus information
Sophos Virus info is the area of the Sophos website that includes information
about common viruses and how to disinfect them. You can access it by browsing
the Sophos website, or via the Sophos Anti−Virus window.
This section describes how to access Sophos Virus info.
How to find out about a virus via the Sophos
Anti−Virus window
To open Sophos Virus info, open the Sophos Anti−Virus window. Then click the
button shown below.
Alternatively, with the Sophos Anti−Virus window open, on the Special menu,
choose Virus Info.
At the resulting prompt, make your choice. If you click Continue, you are taken to
the virus information section of the Sophos website.
How to find out about a virus via the on−screen log
In the Sophos Anti−Virus window, click Details to display the on−screen log. If a
virus has been reported, double−click the line containing the name of the virus.
24
Sophos Anti−Virus for Mac OS X
Finding virus information
At the resulting prompt, make your choice. If you select Continue, you are taken
to the virus information section of the Sophos website.
How to find out about a virus via the web
To go directly to the virus information section of the Sophos website, go to
www.sophos.com/virusinfo/analyses and search for information on the virus.
25
Disinfection
This section describes how to
• set up automatic disinfection
• carry out manual disinfection.
How to set up automatic disinfection
Sophos Anti−Virus can disinfect infected documents or program files
automatically.
You set disinfection preferences separately for immediate and on−access
scanning.
Disinfection preferences for immediate scanning
Open the Immediate Scanning Preferences window. On the Immediate Scan
menu, choose Disinfection.
Enable Disinfection
Select this to enable automatic disinfection of infected documents or program files
found during scanning.
26
Sophos Anti−Virus for Mac OS X
Disinfection
Confirm Disinfection
Select this to ensure Sophos Anti−Virus prompts for confirmation before it
attempts disinfection.
Action On Infected Files
Select this to specify the action taken against infected files if you are not using
automatic disinfection, or if disinfection fails. Sophos Anti−Virus can delete a file,
move it to prevent it being run, or copy it to a specified folder for further analysis.
Click Select to specify the folder where infected files are placed.
Disinfection preferences for on−access scanning
Open the Sophos Anti−Virus preferences pages. Click the padlock icon and enter
your username and password, so that you can make changes.
At the top of the Scanning tabbed page, on the pop−up menu, choose
Disinfection. Change the settings (described below) and then click Set to put
them into effect.
27
Sophos Anti−Virus for Mac OS X
Disinfection
Enable disinfection
Select this to enable automatic disinfection of infected documents or program files
found during scanning.
Action on infected files
Select this to specify the action taken against infected files if you are not using
automatic disinfection, or if disinfection fails. Sophos Anti−Virus can delete a file,
move it to prevent it being run, or copy it to a specified folder for further analysis.
Click Select to specify the folder where infected files are placed.
How to carry out manual disinfection
If you have not enabled automatic disinfection, or if Sophos Anti−Virus cannot
disinfect the infected file, attempt manual disinfection, as follows.
Isolate infected computers from the network and internet.
Write down the name of the virus. Then, from an uninfected computer, look up its
virus analysis on the Sophos website.
www.sophos.com/virusinfo/analyses
The analysis provides information about the virus and how to disinfect it. It may
include a link to detailed disinfection instructions.
If there are no instructions, or the virus analysis tells you to seek advice, contact
Sophos technical support.
28
Updating Sophos Anti−Virus
Sophos Anti−Virus must be updated regularly to enable it to detect all the latest
viruses.
If your computer is on a network, or if your administrator has installed Sophos
Anti−Virus for you, Sophos Anti−Virus has probably already been configured to
update itself automatically.
If you need to set up automatic updating, or want to change the updating settings,
you can do so.
This section describes how to:
• update manually
• set up automatic updating
• set a source for updates
• set an alternative source for updates
• schedule updates
• update via a proxy
• check the progress of an update
• receive desktop alerts about updates
• log updates.
How to update manually
If you have installed Sophos Anti−Virus as recommended in Sophos
documentation, updating occurs automatically.
If you have set up automatic updating, you can also update Sophos Anti−Virus
manually.
Locate the Sophos Anti−Virus icon in the system status bar (shown below).
Click it and choose Update Now.
Provided Sophos Anti−Virus has been correctly configured, it checks the usual
source for new software and, if necessary, updates itself.
For information on configuring updating, see the other pages in this section.
29
Sophos Anti−Virus for Mac OS X
Updating Sophos Anti−Virus
How to set up automatic updating
If your computer is on a network, or if your administrator installed Sophos
Anti−Virus for you, Sophos Anti−Virus has usually been set to update itself
automatically.
If automatic updating has not been set up, follow the steps below. For full
information on the options at each step, see the section describing that
configuration page.
Open the Sophos Anti−Virus preferences pages (see How to open the
preferences pages). Click the padlock icon and enter your username and
password, so that you can make changes.
At the top of the AutoUpdate tabbed page, on the pop−up menu, choose
Network Settings. Click the Primary Server tab. Set the source for updates (see
How to set a source for updates). Your administrator gives you the details you
need to enter.
On the pop−up menu, choose Scheduling and schedule updates (see How to
schedule updates).
30
Sophos Anti−Virus for Mac OS X
Updating Sophos Anti−Virus
How to set a source for updates
If you want Sophos Anti−Virus to update itself automatically, you must specify
where it fetches updates from.
Open the Sophos Anti−Virus preferences pages (see How to open the
preferences pages). Click the padlock icon and enter your username and
password, so that you can make changes.
At the top of the AutoUpdate tabbed page, on the pop−up menu, choose
Network Settings. Click the Primary Server tab. Change the settings (described
below) and then click Set to put them into effect.
31
Sophos Anti−Virus for Mac OS X
Updating Sophos Anti−Virus
Your administrator supplies you with the address and account details you
need.
Sophos
Click this to enable Sophos Anti−Virus to download updates directly from Sophos
via the internet.
Company web server
Click this to enable Sophos Anti−Virus to download updates from your company
web server. Type the web address in the URL text box.
Network volume
Click this to enable Sophos Anti−Virus to download updates from your company
network. Type the network address in the URL text box.
User name
If necessary, type the User name for the account that will be used to access the
update source you have selected, and then enter the Password.
If you access the internet via a proxy server, click the Primary Proxy tab. Note
that some internet service providers require web requests to be sent to a proxy
server.
32
Sophos Anti−Virus for Mac OS X
Updating Sophos Anti−Virus
How to set an alternative source for updates
You can set an alternative source for updates. If Sophos Anti−Virus cannot
contact its usual source, it will attempt to update from this alternative source.
Open the Sophos Anti−Virus preferences pages (see How to open the
preferences pages). Click the padlock icon and enter your username and
password, so that you can make changes.
At the top of the AutoUpdate tabbed page, on the pop−up menu, choose
Network Settings. Click the Secondary Server tab. Change the settings
(described below) and then click Set to put them into effect.
Your administrator supplies you with the address and account details you
need.
Use secondary server
Select this to enable Sophos Anti−Virus to update from this alternative source.
Sophos
Click this to enable Sophos Anti−Virus to download updates directly from Sophos
via the internet.
33
Sophos Anti−Virus for Mac OS X
Updating Sophos Anti−Virus
Company web server
Click this to enable Sophos Anti−Virus to download updates from your company
web server. Type the web address in the URL text box.
Network volume
Click this to enable Sophos Anti−Virus to download updates from your company
network. Type the network address in the URL text box.
User name
If necessary, type the User name for the account that will be used to access the
update source you have selected, and then enter the Password.
If you access the internet via a proxy server, click the Secondary Proxy tab. Note
that some internet service providers require web requests to be sent to a proxy
server.
How to schedule updates
You can specify when or how often Sophos Anti−Virus updates itself.
Open the Sophos Anti−Virus preferences pages (see How to open the
preferences pages). Click the padlock icon and enter your username and
password, so that you can make changes.
At the top of the AutoUpdate tabbed page, on the pop−up menu, choose
Scheduling. Change the settings (described below) and then click Set to put
them into effect.
34
Sophos Anti−Virus for Mac OS X
Updating Sophos Anti−Virus
If you want Sophos Anti−Virus to update itself at regular intervals, select Every
and enter the time period.
If you want Sophos Anti−Virus to update itself every time a network connection is
established, select When connection is made to network/internet.
How to update via a proxy
If Sophos Anti−Virus fetches updates via the internet, you must enter details of
any proxy server that you use to connect to the internet.
Open the Sophos Anti−Virus preferences pages (see How to open the
preferences pages). Click the padlock icon and enter your username and
password, so that you can make changes.
At the top of the AutoUpdate tabbed page, on the pop−up menu, choose
Network Settings. Click the Primary Server tab or the Secondary Server tab as
required. Ensure that all the details have been correctly entered. Then click the
Primary Proxy tab or the Secondary Proxy tab as required. Change the settings
(described below) and then click Set to put them into effect.
35
Sophos Anti−Virus for Mac OS X
Updating Sophos Anti−Virus
Use system proxy settings
Click this to enable Sophos Anti−Virus to use the proxy settings that have been
set up in the system preferences.
Use custom proxy settings
Click this to enable Sophos Anti−Virus to use the proxy settings that you enter on
this tabbed page. Type the settings in the Address, Port, User name and
Password text boxes.
Do not use proxy
Click this if you don't want Sophos Anti−Virus to connect via a proxy.
How to check the progress of an update
Locate the Sophos Anti−Virus icon in the system status bar (shown below).
Click it and choose Show AutoUpdate Window.
36
Sophos Anti−Virus for Mac OS X
Updating Sophos Anti−Virus
See also How to receive desktop alerts about updates and How to log updates.
How to receive desktop alerts about updates
You can configure Sophos Anti−Virus to display desktop alerts during updating.
These alerts are displayed only if AutoUpdate Status is not displayed.
Open the Sophos Anti−Virus preferences pages (see How to open the
preferences pages). Click the padlock icon and enter your username and
password, so that you can make changes.
At the top of the AutoUpdate tabbed page, on the pop−up menu, choose
Desktop Alerts. Change the settings (described below) and then click Set to put
them into effect.
Enable desktop alerts
Select this to enable Sophos Anti−Virus to display alerts in a pop−up box. There
are two levels of alerting:
37
Sophos Anti−Virus for Mac OS X
Updating Sophos Anti−Virus
If you click Errors, Sophos Anti−Virus will display only messages about updating
errors.
If you click Errors and status messages, it will display messages about updating
errors and progress.
How to log updates
You can configure Sophos Anti−Virus to record updating activity in a log file.
Open the Sophos Anti−Virus preferences pages (see How to open the
preferences pages). Click the padlock icon and enter your username and
password, so that you can make changes.
At the top of the AutoUpdate tabbed page, on the pop−up menu, choose
Logging. Change the settings (described below) and then click Set to put them
into effect.
Logging into system log
Select this to enable Sophos Anti−Virus to log all updating activity in the system
log.
38
Sophos Anti−Virus for Mac OS X
Updating Sophos Anti−Virus
Logging into a file
Select this to enable Sophos Anti−Virus to log all updating activity in a log file on
disk.
Click Select to specify the folder for the log file. The default is the Logs folder.
In the File name text box, type the log file name. The default is "Sophos
AutoUpdate Log.txt".
Click View Log File to view the log file in a separate window. Click Purge Log
File to purge the contents of the log file.
39
Troubleshooting
This section provides answers to some common problems that you may
encounter when using Sophos Anti−Virus.
• Sophos Anti−Virus icon has a white cross
• Sophos Anti−Virus icon is greyed out
• Updating fails to happen
• Document not disinfected
• Virus fragment reported
• Sophos Anti−Virus reports errors
Sophos Anti−Virus icon has a white cross
If a white cross is superimposed on the Sophos Anti−Virus icon, updating has
failed. See Updating fails to happen.
Sophos Anti−Virus icon is greyed out
If the Sophos Anti−Virus icon is greyed out, the computer is not protected by
on−access scanning.
To enable on−access scanning, see How to start and stop on−access scanning.
Updating fails to happen
To find out more about an update failure, look at the update log, as follows. Open
the Sophos Anti−Virus preferences pages (see How to open the preferences
pages). At the top of the AutoUpdate tabbed page, on the pop−up menu, choose
Logging. Click View Log File.
The sections below explain why updating may fail, and how you can change the
settings to correct the problem.
Sophos Anti−Virus contacts the wrong source for updates
Open the Sophos Anti−Virus preferences pages (see How to open the
preferences pages). Click the padlock icon and enter your username and
password, so that you can make changes.
At the top of the AutoUpdate tabbed page, on the pop−up menu, choose
Network Settings. Click the Primary Server tab. Check that the address and
account details are those supplied by your administrator (see How to set a source
for updates). Click Set to put them into effect.
40
Sophos Anti−Virus for Mac OS X
Troubleshooting
Sophos Anti−Virus cannot use your proxy server
If your copy of Sophos Anti−Virus updates itself via the internet, you must ensure
that it can use your proxy server (if there is one).
Open the Sophos Anti−Virus preferences pages (see How to open the
preferences pages). Click the padlock icon and enter your username and
password, so that you can make changes.
At the top of the AutoUpdate tabbed page, on the pop−up menu, choose
Network Settings. Click the Primary Proxy tab. Enter the proxy server address
and port number, and the account details (see How to update via a proxy). Click
Set to put them into effect.
Automatic updating is not correctly scheduled
Open the Sophos Anti−Virus preferences pages (see How to open the
preferences pages). Click the padlock icon and enter your username and
password, so that you can make changes.
At the top of the AutoUpdate tabbed page, on the pop−up menu, choose
Scheduling. Choose the scheduling options you require (see How to set up
automatic updating). Click Set to put them into effect.
The source for updates is not being maintained
Your company may have moved the folder (on the network or on a web server)
from which you should update. Alternatively, it may not be maintaining the folder.
If you think this may be the case, contact your network administrator.
Document not disinfected
Sophos Anti−Virus may report that an infected document has not been
disinfected. This could be because
• the infected item is on a write−protected disk or removable medium
• Sophos Anti−Virus has discovered a virus fragment rather than an active
virus.
Remember that automatic disinfection is available only if it has been enabled.
Disinfection is configured separately for immediate and on−access scanning. See
How to edit disinfection preferences.
41
Sophos Anti−Virus for Mac OS X
Troubleshooting
Virus fragment reported
If a virus fragment is reported, contact Sophos technical support for advice.
The report of a virus fragment indicates that part of a file matches part of a virus.
There are three possible causes:
Variant of a known virus
Many new viruses are based on existing ones, so that code fragments typical of a
known virus may appear in files infected with a new one. If a virus fragment is
reported, it is possible that Sophos Anti−Virus has detected a new virus, which
could become active.
Corrupted virus
Many viruses contain bugs in their replication routines that cause them to infect
target files incorrectly. An inactive portion of the virus (possibly a substantial part)
may appear within the host file, and this is detected by Sophos Anti−Virus. A
corrupted virus cannot spread.
Database containing a virus
When running a full scan, Sophos Anti−Virus may report that there is a virus
fragment in a database file.
Sophos Anti−Virus reports errors
After a scan, Sophos Anti−Virus may report that some errors were found. There
are two main reasons for errors:
File is corrupt
Sophos Anti−Virus therefore cannot scan the file.
File is encrypted
If the file contains macros (e.g. it is a .doc or .xls file), only the main body of the
file will have been encrypted (not the macros). You may be warned that the file is
encrypted, but the parts of the file that can contain macro viruses are still
scanned.
42
Sophos Anti−Virus for Mac OS X
Troubleshooting
Getting further help
For technical support, visit
www.sophos.com/support
If you contact technical support, provide as much information as possible,
including Sophos software version number(s), operating system(s) and patch
level(s), and the exact text of any error messages.
43
Using Sophos Anti−Virus via Terminal
You can run immediate scans via Terminal, Mac OS X's command line interface.
To do this, do as follows.
In a Finder window, click Applications. Then click Utilities.
Double−click Terminal to open Terminal.
At the prompt, enter
sweep −h
to display a list of command line options that can be used with the sweep
command.
44
">