TweetFollow Us on Twitter

Real World Review: Sophos Anti-Virus for Mac, Home Edition

Volume Number: 27
Issue Number: 01
Column Tag: Real World Review

Real World Review: Sophos Anti-Virus for Mac, Home Edition

Enterprise-grade antivirus software, now free for home Macs

by Joshua Long

Introduction

Businesses are often required by laws and company policies to run antivirus software on all their computers, Macs included. In the home environment, however, there are no such requirements, and Mac users have debated for years about whether they should go to the trouble of running antivirus software. Is it really worthwhile to spend $40 every year to protect a Mac with commercial-grade antivirus software, or to endure the agonizing speed degradation commonly associated with AV? Thanks to Sophos, home users can now have quality protection without these frustrations.

Why Mac antivirus software?

Enterprise antivirus maker Sophos announced in November that they would begin offering a free Home Edition of Sophos Anti-Virus to all Mac users. The announcement came just one week after SecureMac and Intego had independently published information about new Java-based Mac malware spreading through Facebook and other sites, dubbed Boonana by SecureMac and identified as a variant of the Koobface malware by Intego.

Two weeks after the release of Sophos Anti-Virus for Mac Home Edition, Sophos released a report showing that a significant number of Macs running their software had been infected with malware. This malware included both Mac-native threats as well as plenty of Java-based malware, which Sophos pointed out "could easily be adapted to download Mac-based threats," as was the case with Boonana. Two Mac-specific threats, OSX/Jahlav-C and OSX/DNSCha-E, were each found on about 1 in every 100 Macs scanned. (For the full Sophos report, see http://macte.ch/sophos_stats).

Sophos vs the competition

Sophos' antivirus engine is one of the best on the market. In AV-Comparatives' (av-comparatives.org) November 2010 tests of proactive detection of new malware, Sophos Anti-Virus ranked in the top three PC antivirus products, earning the highest certification level (Advanced+). The tests also took into consideration the number of false positives, of which the Sophos engine had "few."

Let's take a look at how Sophos Anti-Virus Home Edition compares to other free alternatives for the Mac. The two most prominent freeware antivirus solutions are ClamXav (clamxav.com) and PC Tools iAntiVirus (iantivirus.com), and each is very different from Sophos.

ClamXav is free for anyone to use in any environment, from home computers to enterprise workstations. Although ClamXav does not provide on-access scanning of the whole computer, it can be manually configured to scan files that are downloaded or copied to specific folders, for example ~/Downloads and ~/Desktop. Like Sophos, ClamXav detects malware designed for any platform, as opposed to Mac-only malware.

PC Tools iAntiVirus is only free for home use, and although it does offer on-access scanning, it only detects Mac-specific malware. Neither ClamXav nor iAntiVirus is a comprehensive solution compared to Sophos. Of the three, only Sophos will detect infected Web pages and e-mail attachments as soon as they are downloaded, regardless of the threat's target platform.

I tested Sophos and ClamXav with several hundred samples that I've collected from infected computers, Web sites, and e-mails over the past couple years. ClamXav only detected about 75% as many files as Sophos, although ClamXav detected some files (particularly Windows adware) that Sophos did not detect. Neither one detected all the samples, which was expected; no antivirus solution detects 100% of infected or potentially dangerous files.


Figure 1 - Threat detected by Sophos Anti-Virus

Effectiveness

Unlike most full-featured antivirus solutions, the default settings of Sophos Anti-Virus do not automatically delete infected files or prompt users to do so. Instead, Sophos displays an alert informing the user that a threat has been detected, with options to open the Quarantine Manager or close the dialog box, and the latter is the default selection. Regardless of which option the user chooses, as long as Sophos' on-access scanner is enabled, the file is inaccessible and cannot be opened or even duplicated in the Finder or the Terminal (even using sudo).


Figure 2 - When a threat is found, Sophos denies access by default

If a malicious Mac application is detected by Sophos, attempting to open the application will result in two Mac OS X dialog boxes informing the user that they can't open the application because it is "not supported on this type of Mac." Thus, Sophos effectively quarantines the files in place.


Figure 3 - Malware is not supported on this type of Mac

Even trying to access quarantined files from another computer via a network share proves fruitless. I had Sophos running on an iMac and no antivirus software on a MacBook Pro. From the MacBook Pro I connected to an AFP share on the iMac and tried to copy a file from the iMac to the local hard drive. This resulted in a Mac OS X dialog box explaining that I did not have permission to access the file. I also tried to duplicate an infected file in-place on the network share, which caused the MacBook Pro's Finder to crash and relaunch (note to self: file a bug report). In any case, Sophos quarantines files on the local system in such a way that they cannot be accessed by remote systems.

Annoyances

One strange and annoying issue I've encountered is that Sophos Anti-Virus frequently grays out the Clean Up Threat button for items that should be easy for Sophos to delete on its own. For example, the action available for dealing with .zip files downloaded from parcel scam e-mails is Clean up manually, meaning that users must try to locate the infected files on their computer. This may or may not be easy, depending on whether the full path is shown in the Quarantine Manager; if the path or file name is too long, the path will be truncated, so you may have to use Spotlight or a third-party search utility to locate the file (refer to the screenshot of the Quarantine Manager). You cannot resize the window so there is no way to see the full path, and there is no Show in Finder option either.


Figure 4 - "Clean up manually"... okay, so what's the full path?

In other cases, instead of Clean up manually the available action will be Restart Mac instead, even when there's absolutely no reason why that should be necessary. I came across this after downloading fake ActiveX video codec malware, which consisted of nothing more than Windows .exe files. Why on earth would Sophos need to restart the computer to clean Windows executables that aren't in use? Worse still, restarting your Mac won't even clean up the threat; it will still be there in the Quarantine Manager after restarting.

Fortunately, Sophos did not gray out the Clean Up Threat button for the Mac OS X-specific threat I had it scan (a dangerous Space Invaders-style game called lose/lose which deletes files in the user's home directory when you destroy enemy spaceships); no manual deletion or restarting is required to clean that Mac-native threat.

Speed

Antivirus suites have a reputation of slowing down computers. In my testing, there was no noticeable decrease in system speed or usability after installing the Sophos software. I even tested it on a low-end Hackintosh netbook (a Dell Mini 10v with a 1.6 GHz Intel Atom processor and 1 GB RAM) and the system was still quite usable after installing Sophos.

Conclusion

For those who support Macs in a home environment, I recommend trying Sophos Anti-Virus for Mac Home Edition. Although there's currently only a small amount of Mac-specific malware in the wild, Sophos can protect Macs from other threats such as malicious JavaScript redirectors, Adobe Flash files that exploit known vulnerabilities (see Mike Hjörleifsson's CoreSec column in the MacTech November 2010 issue), multiplatform Java-based attacks like Boonana, and Windows-based malware that could accidentally be opened in a virtual environment like Parallels or VMware, and it can also discover infections on USB flash drives that you might have picked up from an infected PC unbeknownst to you.

It's time for us to put away our Smug Virus-Free Mac User shirts of yore and become more proactive at defending Macs from security threats. Three cheers to Sophos for lighting the way into battle.


Joshua Long has a master’s degree in IT concentrating in Internet Security, is a Security+ certified professional, and is currently earning a Ph.D. in Business Administration specializing in Computer and Information Security. Josh writes about malware and other information security topics at security.thejoshmeister.com. He is also the producer and host of MacTech Magazine’s official podcast, MacTech Live (www.mactech.com/live). You can follow him on Twitter @theJoshMeister or contact him via e-mail at jlong@mactech.com.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Adobe InDesign 17.0 - Professional print...
InDesign is available as part of Adobe Creative Cloud for as little as $20.99/month (or $9.99/month if you're a previous InDesign customer). Adobe InDesign is part of Creative Cloud. That means you... Read more
Adobe InCopy 17.0 - Create streamlined e...
InCopy is available as part of Adobe Creative Cloud for $52.99/month (or $4.99/month for InCopy app only). Adobe InCopy, ideal for large team projects involving both written copy and design work,... Read more
Geekbench 5.4.2 - Measure processor and...
Geekbench provides a comprehensive set of benchmarks engineered to quickly and accurately measure processor and memory performance. Designed to make benchmarks easy to run and easy to understand,... Read more
Adobe Dreamweaver CC 21.2 - Build world-...
Dreamweaver CC is available as part of Adobe Creative Cloud for as little as $20.99/month (or $9.99/month if you're a previous Dreamweaver customer). Adobe Dreamweaver CC allows you to design,... Read more
OmniOutliner Pro 5.9 - Pro version of th...
OmniOutliner Pro is a flexible program for creating, collecting, and organizing information. Give your creativity a kick start by using an application that's actually designed to help you think. It's... Read more
TinkerTool 8.3 - Expanded preference set...
TinkerTool is an application that gives you access to additional preference settings Apple has built into Mac OS X. This allows to activate hidden features in the operating system and in some of the... Read more
Network Radar 3.0 - $17.99
Network Radar is an advanced network scanning and managing tool. Featuring an easy-to-use and streamlined design, the all-new Network Radar 2 has been engineered from the ground up as a modern Mac... Read more
BusyContacts 1.6.1 - Fast, efficient con...
BusyContacts is a contact manager for OS X that makes creating, finding, and managing contacts faster and more efficient. It brings to contact management the same power, flexibility, and sharing... Read more
MacPilot 13.0.1 - $15.96 (53% off)
MacPilot gives you the power of UNIX and the simplicity of Macintosh, which means a phenomenal amount of untapped power in your hands! Use MacPilot to unlock over 1,200 features, and access them all... Read more
OmniOutliner Essentials 5.9 - Organize y...
OmniOutliner Essentials (was OmniOutliner) is a flexible program for creating, collecting, and organizing information. Give your creativity a kick start by using an application that's actually... Read more

Latest Forum Discussions

See All

‘RPG Dice: Heroes of Whitestone’ Now Ava...
WIMO Games, a new studio comprised of industry veterans, have announced a pre-registration campaign and global release window for their tabletop-inspired mobile game RPG Dice: Heroes of Whitestone. After 500 years of relative peace, chaos befalls... | Read more »
‘Hatsune Miku: Colorful Stage’ Launching...
It was just over two years ago in August of 2019 that SEGA in partnership with Colorful Palette announced a new mobile game starring everybody’s favorite virtual idol Hatsune Miku. The game was formally announced the following October as Project... | Read more »
SwitchArcade Round-Up: ‘Mary Skelter Fin...
Hello gentle readers, and welcome to the SwitchArcade Round-Up for October 26th, 2021. In today’s article, we’ve got a little bit of news to check out regarding the next Tetris 99 event. Our pal Mikhail has a full-pants review of Mary Skelter Finale... | Read more »
‘Kathy Rain: Director’s Cut’ Is Out Now...
Kathy Rain from Clifftop Games and Raw Fury hit iOS back in 2016, and it has been supercharged with Kathy Rain: Director’s Cut ($4.99) out now. | Read more »
‘Final Gear’s Summer Memories Limited-Ti...
KOMOE TECHNOLOGY LIMITED is heating things up with Final Gear’s Summer Memories limited-time event. Players can enjoy the tactical mobile RPG with extra contents such as event instances, boss stages, and exclusive summertime mechs. | Read more »
How to find and defeat Queen Slime in Te...
If it wasn’t for quirky bosses and action-packed boss battles, Terraria would have been rather meh. But, as you explore each region of the game, you come across enemies, bosses, and mini-bosses that keep things interesting. [Read more] | Read more »
‘Man Vs. Missiles’ Halloween Update with...
Earlier this year, Spiel Studios’ Man Vs. Missiles (Free) got two major updates. The first was the big third birthday version 8.0 update that added happy hours, new planes, an improved interface, and more. Following that, Man Vs. | Read more »
SwitchArcade Round-Up: Reviews Featuring...
Hello gentle readers, and welcome to the SwitchArcade Round-Up for October 25th, 2021. In today’s article, we’ve got a small slice of news before we head into a pack of reviews. Lots of games in the Comfy Chair of Evaluation today, including The... | Read more »
Best iPhone Game Updates: ‘Horizon Chase...
Hello everyone, and welcome to the week! It’s time once again for our look back at the noteworthy updates of the last seven days. Some big names in this week’s round-up, with a general theme that I would characterize as nostalgic. Not every game... | Read more »
‘Fantasy Life Online’ from Level-5 Is Ge...
Back in 2018, Level-5 released Fantasy Life Online for iOS and Android in Japan. Fantasy Life Online is a follow-up to the amazing Nintendo 3DS game Fantasy Life. Fantasy Life is one of my favourite and most-played games on that platform, so I was... | Read more »

Price Scanner via MacPrices.net

14-inch 8-Core M1 Pro MacBook Pro on preorder...
B&H Photo has the base 14″ 8-Core M1 Pro MacBook Pro, Space Gray, on sale for $1949 including free expedited shipping to most US addresses. Their price is $50 off Apple’s MSRP, and it’s currently... Read more
Apple restocks 13″ MacBook Airs with M1 CPUs...
Apple has restocked a full line of 2020 13″ M1 MacBook Airs, Certified Refurbished, starting at only $849 and up to $190 off original MSRP. These are the cheapest M1-powered MacBooks for sale today... Read more
Apple’s 13″ MacBook Pros with M1 CPUs are on...
Amazon has Apple’s 13″ MacBook Pros with M1 Apple Silicon processors on sale for $120-$250 off MSRP this week, starting at $1169. Shipping is free: – 2020 13″ MacBook Pro Space Gray M1 CPU/256GB SSD... Read more
Limited time sale: Pink AirPods Max for $434,...
Abt Electronics has Apple’s Pink AirPods Max headphones in stock and on sale for a limited time for $434 shipped. Their price is $115 off Apple’s MSRP, and it’s the lowest price available for any... Read more
Apple restocks Apple Watch SE 40mm GPS + Cell...
Apple has restocked Certified Refurbished Apple Watch SE models (40mm GPS + Cellular, Aluminum Case/Black Sport Band) in their online store for $50 off MSRP, only $279. Each Watch includes Apple’s... Read more
Apple continues to offer 13″ M1 MacBook Pros,...
Apple has a full line of 2020 13″ M1 MacBook Pros available Certified Refurbished, starting at only $1099 and up to $230 off original MSRP. These are the cheapest M1 MacBook Pros for sale today at... Read more
256GB 8.3″ iPad mini on sale for $599, take $...
Amazon has the new 8.3″ 256GB WiFi iPad mini on sale today for $599 including free shipping. Delivery is expect around November 9th. Amazon’s price is $50 off Apple’s MSRP, and it’s the lowest price... Read more
A Look Back At ‘The gadget of the century,’ A...
FEATURE: 10.23.21 – It’s been two decades since a device that put 1,000 songs in our pockets would forever change the way we listened to music. The iPod — which Apple announced on October 23, 2001 —... Read more
Get Apple’s new AirPods Pro with MagSafe Case...
Amazon has Apple’s new 2021 AirPods Pro with MagSafe Case in stock and on sale for $219 shipped. Their price is $30 off Apple’s MSRP, and it’s the first discount we’ve seen on 2021 AirPods Pro. For... Read more
First discounts appear at Amazon with new 14″...
Amazon is offering $50 discounts on a couple of new 14″ M1 MacBook Pros and 16″ M1 MacBook Pros. Preorder today, and Amazon will ship once they receive stock. We expect Amazon’s $50 discount to... Read more

Jobs Board

*Apple* Engineering Specialist - General Dyn...
…innovative IT Service Delivery solutions to SEC. Currently, we are seeking an Apple Engineering Specialist in Washington, DC Candidates must be US Citizens (without Read more
Sephora Beauty Advisor - *Apple* Blossom Ma...
Sephora Beauty Advisor - Apple Blossom Mall Location:Winchester, VA, United States (https://jobs.jcp.com/jobs/location/191170/winchester-va-united-states) - Apple Read more
Geek Squad Advanced Repair *Apple* Professi...
**838870BR** **Job Title:** Geek Squad Advanced Repair Apple Professional **Job Category:** Store Associates **Store Number or Department:** 000056-Cedar Hill-Store Read more
Sales Floor Associate - *Apple* Blossom Mal...
Sales Floor Associate - Apple Blossom Mall Location:Winchester, VA, United States (https://jobs.jcp.com/jobs/location/191170/winchester-va-united-states) - Apple Read more
Seasonal Operations Associate - *Apple* Blo...
Seasonal Operations Associate - Apple Blossom Mall Location:Winchester, VA, United States (https://jobs.jcp.com/jobs/location/191170/winchester-va-united-states) - Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.