Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 12 replies
  • Subscribers 6 subscribers
  • Views 3188 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Possible Bug?

LDMartin1959

I originally posted this on the main Sophos forums and was chastised and told to post it here. I was directed to do this by a forum moderator, so please do not criticise me for cross-posting.

I have noticed an odd situation. I am using the free Mac edition on Lion. Sophos keeps reporting infection in a couple of files in my Time Machine backup. But it does not report infection of the same files on the primary drive where the primary/original copies of those files reside. It simply doesn't make sense that the primary/original copy of a file could be free of infection and the backup copy made from that primary/original file could be infected. Rationally, one of these things is wrong: Rationally, either they are both infected or neither are infected. Not sure which is the case, but it certianly shakes myfaith in Sophos AntiVirus.

Update: Since my initial posting on the main forums, I've noticed one additional apparant anomoly in this matter. Amoung the multiple references to "Original Locations" for each infected file are some "Original Locations" which seem to make no sense. For example, a reported infected Windows .DLL file includes an identification of originally being a .WMA file, and a reported infected Windows .EXE  file includes an identification of originally being a .RM file. Ignoring the fact that these "original location" references are nonsensical, even if we were to accept for the moment that these file name/format transformations did somehow occur, there is still the fact that these referenced "original" files do not report as being infected. As I say, all this certianly shakes my faith in Sophos AntiVirus.

As I mention in the thread on the main forums, my posting was and is in reference to a possible bug and to (hopefully) bring the matter to the attention of the Sophos folks so that if it is a bug it can be addressed. This is not principly a request for support or assistance to solve/explain my dilema, although such will be gladly accepted.

:1008143


This thread was automatically locked due to age.
Parents
  • 0

    With regard to your comment about 'original locations', it's interesting that the files you mentioned originally appeared to be media files. I was recently asked by a neighbour to help them secure their Mac and ran the Home Edition product on it. It reported a whole load of Windows malware in files whose names suggested they were MP3s, WMAs or other media files. They had all been downloaded from media sharing services or sites like Limewire. Looking at the files more closely, it was clear they were Windows executables, but they had been placed on media sharing sites to try and trick Windows users into running them.

    Regarding the Time Machine issue, is it possible that the original files have been disinfected and the old copies are still there in an old backup, or are the infected items in very recent backups? If you've changed the original file, wouldn't Time Machine still keep a copy of the original as well as a copy of the new (clean) version - after all, that's what it's supposed to do in the case of legitimate changes to files such as editing documents, modifying photos, etc.

    Regards

    Rich

    :1008169
Reply
  • 0

    With regard to your comment about 'original locations', it's interesting that the files you mentioned originally appeared to be media files. I was recently asked by a neighbour to help them secure their Mac and ran the Home Edition product on it. It reported a whole load of Windows malware in files whose names suggested they were MP3s, WMAs or other media files. They had all been downloaded from media sharing services or sites like Limewire. Looking at the files more closely, it was clear they were Windows executables, but they had been placed on media sharing sites to try and trick Windows users into running them.

    Regarding the Time Machine issue, is it possible that the original files have been disinfected and the old copies are still there in an old backup, or are the infected items in very recent backups? If you've changed the original file, wouldn't Time Machine still keep a copy of the original as well as a copy of the new (clean) version - after all, that's what it's supposed to do in the case of legitimate changes to files such as editing documents, modifying photos, etc.

    Regards

    Rich

    :1008169
Children
No Data