Labs

Traditionally, Sophos has concentrated on protecting networks rather than single users and, as a consequence, offers a number of features not found in competing products.

Its Anti-Virus product is built around a locally installed InterCheck utility that scans all files on access and adds a checksum for each one to a locally held list to denote it's clean. Any subsequent accesses to authorised files don't require the scanning process to be started again, so workstation overheads are reduced considerably. Only if a file is updated or if new ones are copied or created on the workstation will InterCheck verify them first.

All users see is a small InterCheck Monitor icon in the System Tray that allows them to view current anti-viral activity and a log file. The advantages of this method are almost total transparency and a minimal impact

ADVERTISEMENT

on local and network performance.

The SAVAdmin utility provides a tidy management interface from where the client software can be deployed to other servers and workstations using a central installation point and login script. It can auto-detect new systems and deploy the software automatically, but requires an agent to be installed locally to monitor Windows 95, 98 and ME systems. A separate Auto-upgrade feature checks each user's workstation when they log on and downloads and applies any program updates and new virus identification files that are held on the central server.

Each user gets their own copy of Anti-Virus Sweep to play with, but the main interface hasn't been changed for many years now. However, it's simple for users to select drives for on-demand scans or to schedule a scan for regular intervals.

Deployment of Sophos' virus identity files and program updates has been made easier with the new Enterprise Manager, as this MMC snap-in is designed to run scheduled and manual downloads from Sophos' secure website and automatically deploy them across the network. Reactions to a positive detection are plentiful, and Anti-Virus can shred infected files by overwriting their physical location so they can't be recovered. Reporting is also reasonably good. Anti-Virus is able to send network broadcasts to specific users or systems, email messages to any number of recipients and generate SNMP events.