Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 12 replies
  • Subscribers 6 subscribers
  • Views 3186 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Possible Bug?

LDMartin1959

I originally posted this on the main Sophos forums and was chastised and told to post it here. I was directed to do this by a forum moderator, so please do not criticise me for cross-posting.

I have noticed an odd situation. I am using the free Mac edition on Lion. Sophos keeps reporting infection in a couple of files in my Time Machine backup. But it does not report infection of the same files on the primary drive where the primary/original copies of those files reside. It simply doesn't make sense that the primary/original copy of a file could be free of infection and the backup copy made from that primary/original file could be infected. Rationally, one of these things is wrong: Rationally, either they are both infected or neither are infected. Not sure which is the case, but it certianly shakes myfaith in Sophos AntiVirus.

Update: Since my initial posting on the main forums, I've noticed one additional apparant anomoly in this matter. Amoung the multiple references to "Original Locations" for each infected file are some "Original Locations" which seem to make no sense. For example, a reported infected Windows .DLL file includes an identification of originally being a .WMA file, and a reported infected Windows .EXE  file includes an identification of originally being a .RM file. Ignoring the fact that these "original location" references are nonsensical, even if we were to accept for the moment that these file name/format transformations did somehow occur, there is still the fact that these referenced "original" files do not report as being infected. As I say, all this certianly shakes my faith in Sophos AntiVirus.

As I mention in the thread on the main forums, my posting was and is in reference to a possible bug and to (hopefully) bring the matter to the attention of the Sophos folks so that if it is a bug it can be addressed. This is not principly a request for support or assistance to solve/explain my dilema, although such will be gladly accepted.

:1008143


This thread was automatically locked due to age.
Parents
  • 0
    Agile wrote:

    I believe I can shed some light on this issue.

    The Exploit detection in question detects jpeg files with header sizes that don't match the header structure... which means if the file gets scanned after the jpeg has only been partially been written to disk (which TM sometimes does in the InProgress folders), it will be detected -- even though when the file is completely written, the detection will no longer be there, as the jpeg file will no longer be in an exploitable state, but will once again be a complete jpeg file.

    Re-scanning after the backup is complete should indicate that the files are not infected.

    Two suggestions, then:

    1) Perhaps something can be added to Sophos to detect when a file is still being written and delay scanning until writing is complete (should be useful in preventing false positives in general);

    2) Allow user configuration of the default scanning profile (which currently does not allow any configuration options) to exclude back-up drives (would be useful in preventing false positives in this particular type of situation, or when a specific drive is being used as a scratch drive and has data continually being written to it).

    :1008273
Reply
  • 0
    Agile wrote:

    I believe I can shed some light on this issue.

    The Exploit detection in question detects jpeg files with header sizes that don't match the header structure... which means if the file gets scanned after the jpeg has only been partially been written to disk (which TM sometimes does in the InProgress folders), it will be detected -- even though when the file is completely written, the detection will no longer be there, as the jpeg file will no longer be in an exploitable state, but will once again be a complete jpeg file.

    Re-scanning after the backup is complete should indicate that the files are not infected.

    Two suggestions, then:

    1) Perhaps something can be added to Sophos to detect when a file is still being written and delay scanning until writing is complete (should be useful in preventing false positives in general);

    2) Allow user configuration of the default scanning profile (which currently does not allow any configuration options) to exclude back-up drives (would be useful in preventing false positives in this particular type of situation, or when a specific drive is being used as a scratch drive and has data continually being written to it).

    :1008273
Children
No Data