Problems with Sophos Mac Antivirus Home Edition

Thank you for being so thorough in outlining your issues on these forums.  You likely were having problems with Support because they are set up to handle support of our SBE product only.

The "forever scan" issue has cropped up for a number of users; this seems to be linked to scanning of specific kinds of large archives/Boot Camp partitions.  If you turn off archive scanning, the problem will go away (but you also won't have scanned inside archives).

It sounds like most of your issues are archive-related -- when the scanner hits a large archive, the file count won't go down until after it has fully extracted and scanned all archive contents and is ready to move on to the next item.  For large archives, this can take a very long time, as the scanner is configured to let you get on with your usual work while it scans in the background.  I will flag up the sleep/wake aspect just in case there is some further issue there.  In my own testing, I have not had problems interrupting a scan with a sleep/wake cycle.

The email attachment issue is due to file caching -- even though the original files were fully removed, the OS caches the files from many applications, including Mail -- resulting in the attachment still existing in the Caches folder (it should indicate that it is at that location, however).  The Quarantine list is real-time, so the files should vanish from the list when the cache is purged, even without quitting and relaunching.

The installers you mention would definitely cause a slowdown if you have archive scanning enabled, as the Lion installer is a package archive with multiple levells of archives and disk images inside -- this will take a while to unpack and scan at the best of times, and if it's a partial file, the scanner will attempt to do its best with the parts it can find.  However, the scanner will drop that file and flag an error (which it sounds like it did) as soon as it hits an issue it can't resolve.

From your comments, I take it you're currently running the software on Snow Leopard?

One of the best suggestions I can make re: stability and speed is to disable scanning in archives and compressed files for on-access scans.  This does reduce security slightly, but also prevents actions happening which can cause the majority of performance and stability edge cases.  Unfortunately, these issues will always exist when handling archives; fixing them would result in decreased accuracy/security surrounding scanning of archives (which means, fixing the issue would likely result in archives not getting thoroughly scanned in the first place, removing much of the benefit of enabling such scans).

There are differences between the Home Edition and SBE, but most of those have to do with the interface/reporting/control side -- features are missing from the Home Edition -- the underlying AV engine is the same.  How this affects the issues you have been experiencing is unknown, until we isolate what part of the product is causing your issues.

I'm glad you turned to these forums instead of giving up after your initial negative experiences -- hopefully we can resolve your issues both with the Home Edition and with the SBE offering.  I'd recommend uninstalling the Home Edition and getting the SBE demo -- this will let you see how many of the problems are at the product level and how many are issues with how the underlying engine is functioning.  Plus, support will be able to handle your calls appropriately.

One rule of thumb with AV software: never run two scanners at the same time -- they will almost always conflict.  Sophos does have a product specifically for deploying to VMs which would work in the situation you've outlined, running an end-point scan on the same physical data that you're taking control of with another on-access scanner is a recipe for lock-ups, kernel panics and blue screens.  Pausing your scan while running your VM would likely have prevented the issue.

One last bit of advice: if you do end up trying the SBE offering, these forums are still a great resource for searching for similar problems and solutions to the issues you are facing, as a portion of the product (including detection engine and data) is nearly identical.  I'd also recommend a read through the other issues and solutions presented in these forums as part of your product review -- that way, you will be more equipped should issues arise with the SBE offering.

Thank you for being so thorough in outlining your issues on these forums.  You likely were having problems with Support because they are set up to handle support of our SBE product only.

The "forever scan" issue has cropped up for a number of users; this seems to be linked to scanning of specific kinds of large archives/Boot Camp partitions.  If you turn off archive scanning, the problem will go away (but you also won't have scanned inside archives).

It sounds like most of your issues are archive-related -- when the scanner hits a large archive, the file count won't go down until after it has fully extracted and scanned all archive contents and is ready to move on to the next item.  For large archives, this can take a very long time, as the scanner is configured to let you get on with your usual work while it scans in the background.  I will flag up the sleep/wake aspect just in case there is some further issue there.  In my own testing, I have not had problems interrupting a scan with a sleep/wake cycle.

The email attachment issue is due to file caching -- even though the original files were fully removed, the OS caches the files from many applications, including Mail -- resulting in the attachment still existing in the Caches folder (it should indicate that it is at that location, however).  The Quarantine list is real-time, so the files should vanish from the list when the cache is purged, even without quitting and relaunching.

The installers you mention would definitely cause a slowdown if you have archive scanning enabled, as the Lion installer is a package archive with multiple levells of archives and disk images inside -- this will take a while to unpack and scan at the best of times, and if it's a partial file, the scanner will attempt to do its best with the parts it can find.  However, the scanner will drop that file and flag an error (which it sounds like it did) as soon as it hits an issue it can't resolve.

From your comments, I take it you're currently running the software on Snow Leopard?

One of the best suggestions I can make re: stability and speed is to disable scanning in archives and compressed files for on-access scans.  This does reduce security slightly, but also prevents actions happening which can cause the majority of performance and stability edge cases.  Unfortunately, these issues will always exist when handling archives; fixing them would result in decreased accuracy/security surrounding scanning of archives (which means, fixing the issue would likely result in archives not getting thoroughly scanned in the first place, removing much of the benefit of enabling such scans).

There are differences between the Home Edition and SBE, but most of those have to do with the interface/reporting/control side -- features are missing from the Home Edition -- the underlying AV engine is the same.  How this affects the issues you have been experiencing is unknown, until we isolate what part of the product is causing your issues.

I'm glad you turned to these forums instead of giving up after your initial negative experiences -- hopefully we can resolve your issues both with the Home Edition and with the SBE offering.  I'd recommend uninstalling the Home Edition and getting the SBE demo -- this will let you see how many of the problems are at the product level and how many are issues with how the underlying engine is functioning.  Plus, support will be able to handle your calls appropriately.

One rule of thumb with AV software: never run two scanners at the same time -- they will almost always conflict.  Sophos does have a product specifically for deploying to VMs which would work in the situation you've outlined, running an end-point scan on the same physical data that you're taking control of with another on-access scanner is a recipe for lock-ups, kernel panics and blue screens.  Pausing your scan while running your VM would likely have prevented the issue.

One last bit of advice: if you do end up trying the SBE offering, these forums are still a great resource for searching for similar problems and solutions to the issues you are facing, as a portion of the product (including detection engine and data) is nearly identical.  I'd also recommend a read through the other issues and solutions presented in these forums as part of your product review -- that way, you will be more equipped should issues arise with the SBE offering.