Sophos Anti-Virus

Sophos claims to be one of the largest anti-virus software vendors in the world with its Anti-Virus software designed from the ground up to protect corporate networks. With this focus in mind, it offers a number of features not found with the competition.

InterCheck is a unique utility for real-time virus detection on workstations, offering almost total transparency and minimal impact on local and network performance. When a file is accessed on a workstation, the local InterCheck client scans it first. If deemed clean, a checksum for the file is added to a file listing authorised items held locally on each workstation. Any subsequent accesses to authorised files don't require the scanning process to be started again, so workstation overheads are very much reduced. Only if a file is updated or new ones copied or created will InterCheck verify them first. All users get to see is a small InterCheck Monitor icon in the System Tray, allowing them to view current anti-viral activity and a log file.

A number of options are provided for network installation and the software can be deployed automatically to other servers and workstations once a central installation point and login script are created. The SAVAdmin (Sophos Anti-Virus Administration) console makes this even easier, allowing you to remotely install and configure the anti-virus software. SAVAdmin also looks after task schedules, maintains central installations of Anti-Virus and provides good reporting and monitoring facilities.

A separate Auto-upgrade feature checks each user's workstation when they log on and downloads and applies any program updates and new virus identification files held on the central server. Along with the InterCheck monitor, each user gets their own copy of Anti-Virus Sweep to play with. The main interface hasn't changed for years, but it's simple for users to select drives for on-demand scans or to schedule a scan for regular intervals.

Administrators have plenty of choices on how to deal with infected files. Boot sector viruses can be despatched automatically as can macro viruses. Files can be renamed, moved or copied to another location or deleted, although the latter action isn't recommended in case it's a system file that's infected. You can also shred infected files, as Anti-Virus can overwrite their physical location so they can't be recovered.

From a user's perspective, Anti-Virus keeps a low profile and its reaction to viruses is designed not to cause panic - just a simple screen telling you that a virus has been found and a customisable message from the network administrator. Reporting is extensive, as Anti-Virus can send network broadcasts to specific users or systems, email any number of recipients and generate SNMP events.

The main strengths of Sophos Anti-Virus lie in its simplicity, making it appealing to smaller networks with limited IT support. It's easy to install, deploy and manage, plus it has good reporting and monitoring tools.

Author: Dave Mitchell