Sophos Endpoint Security and Control
4 Sophos Anti-Virus
4.1 About on-access and on-demand scanning
On-access scanning
On-access scanning is your main method of protection against viruses and other threats.
Whenever you open, save, copy or rename a file, Sophos Anti-Virus scans the file and grants access to it only if it does not pose a threat to your computer or has been authorized for use.
For more information, see
Configure on-access scanning (page 10).
On-demand scanning
On-demand scans provide additional protection. As the name suggests, you initiate an on-demand scan. You can scan anything from a single file to your entire computer.
For more information, see
Types of on-demand scan (page 15).
4.2 On-access scanning
4.2.1 About on-access scanning best practice
This section contains recommendations to help you get the best from on-access scanning.
We recommend that you use the default on-access scan settings, as they represent the best balance between protecting your computer against threats and overall system performance. For information about the recommended on-access scan settings, see Sophos support knowledgebase article 114345 ( http://www.sophos.com/en-us/support/knowledgebase/114345.aspx
).
4.2.2 Configure on-access scanning
Caution: On-access scanning may not detect viruses if certain encryption software is installed.
Change the startup processes to ensure that files are decrypted when on-access scanning begins.
For more information on how to use anti-virus and HIPS policy with encryption software, see
Sophos support knowledgebase article 12790 http://www.sophos.com/en-us/support/knowledgebase/12790.aspx
.
Important: If a management console is used to administer Sophos Endpoint Security and Control on this computer, it may override any changes you make here.
10
help
By default, Sophos Anti-Virus detects and cleans up the following threats during an on-access scan:
■
■ viruses
Trojans
■
■ worms spyware
To configure on-access scanning:
1. Click Home > Anti-virus and HIPS > Configure anti-virus and HIPS > Configure >
On-access scanning.
2. To change when on-access scanning occurs, under Check files on, set the options as described below.
Option
Read
Rename
Write
Description
Scan files when they are copied, moved, or opened.
Scan files when they are renamed.
Scan files when they are saved or created.
3. Under Scan for, set the options as described below.
Option
Adware and PUAs
Description
Adware displays advertising (for example, pop-up messages) that may affect user productivity and system efficiency.
PUAs (Potentially Unwanted Applications) are not malicious, but are generally considered unsuitable for business networks.
Suspicious files
Suspicious files exhibit a combination of characteristics that are commonly, but not exclusively, found in viruses.
11
Sophos Endpoint Security and Control
4. Under Other scanning options, set the options as described below.
Option
Allow access to drives with infected boot sectors
Description
Turn on this option to allow access to an infected bootable removable medium or device such as a bootable CD, floppy disk, or USB flash drive.
Use this option only if advised to by Sophos technical support.
See also the Troubleshooting topic
Allow access to drives with infected boot sectors
(page 97).
Scan all files
Scan inside archive files
Scan system memory
We recommend that you leave this option turned
off, as it will affect computer performance adversely. You should scan all files only during a weekly scan.
Turn on this option to scan the contents of archives or compressed files. You need to do this only if you download and distribute such files without extracting the contents.
We recommend that you leave this option turned
off, as it makes scanning significantly slower.
You will still be protected against any threats in archives or compressed files, as any components of an archive or compressed file that may be malware will be blocked by on-access scanning:
When you open a file extracted from the archive file, the extracted file is scanned.
Files compressed with dynamic compression utilities such as PKLite, LZEXE, and Diet are scanned.
Turn on this option to automatically run an hourly background scan that detects malware hiding in the computer's system memory (the memory that is used by the operating system).
Note: This option is available only on 32-bit operating systems.
4.2.3 Temporarily disable on-access scanning
If you are a member of the SophosAdministrator group, you may need to temporarily disable on-access scanning for maintenance or troubleshooting, and then re-enable it. You can disable on-access protection and still run on-demand scans on your computer.
12
help
Sophos Endpoint Security and Control retains the settings you make here, even after you restart your computer. If you disable on-access scanning, your computer is unprotected until you re-enable it.
1. Click Home > Anti-virus and HIPS > Configure anti-virus and HIPS > Configure >
On-access scanning.
2. Clear the Enable on-access scanning for this computer check box.
4.2.4 Configure on-access cleanup
Important: If a management console is used to administer Sophos Endpoint Security and Control on this computer, it may override any changes you make here.
To configure on-access cleanup:
1. Click Home > Anti-virus and HIPS > Configure anti-virus and HIPS > Configure >
On-access scanning.
2. Click the Cleanup tab.
3. To automatically clean up infected items, under Viruses/spyware, select the Automatically
clean up items that contain virus/spyware check box.
Note: If you turn on this option, cleaning up some viruses/spyware will trigger a full system scan, which tries to clean up all the viruses on your computer. This might take a long time.
4. Under Viruses/spyware, select an action for Sophos Anti-Virus to take against infected items if you have disabled automatic cleanup, or if automatic cleanup fails:
Option
Deny access only
Description
Sophos Anti-Virus asks you what to do before continuing.
This is the default setting.
Delete
Deny access and move to
Use these settings only if advised to by Sophos technical support.
Otherwise, use Quarantine Manager to clean your computer of viruses/spyware found by Sophos
Anti-Virus. See Deal with viruses/spyware in quarantine (page 41).
13
Sophos Endpoint Security and Control
5. Under Suspicious files, select an action for Sophos Anti-Virus to take when it finds files containing code that is commonly used in malware:
Option
Deny access
Description
Sophos Anti-Virus asks you what to do before continuing.
This is the default setting.
Delete
Deny access and move to
Use these settings only if advised to by Sophos technical support.
Instead, use Quarantine Manager to clean your computer of suspicious files found by Sophos
Anti-Virus. See Deal with suspicious files in quarantine (page 43).
4.2.5 Reset scanned file checksums
The list of scanned file checksums is reset when a Sophos Anti-Virus update occurs, or when you restart your computer. The list is then rebuilt with new data as files are scanned by Sophos
Anti-Virus.
You can reset the list of scanned file checksums from within Sophos Endpoint Security and Control if you do not want to restart your computer.
To reset scanned file checksums:
1. Click Home > Anti-virus and HIPS > Configure anti-virus and HIPS > Configure >
On-access scanning.
2. On the Scanning tab, click Purge cache.
4.2.6 Specify on-access scanning file extensions
Important: If a management console is used to administer Sophos Endpoint Security and Control on this computer, it may override any changes you make here.
You can specify which file extensions are scanned during on-access scanning.
1. Click Home > Anti-virus and HIPS > Configure anti-virus and HIPS > Configure >
On-access scanning.
14
