UPGRADE to version 9.0 of Sophos Anti-Virus for Mac HE

Hi,

My Mac currently has Version 8.0.16C installed and when I run "Update Now", it sometimes says that it is updating, but it's never updating the app itself, even though you have version 9.0 available now. Is this correct behaviour (that it only updates the threat data), or should this function update the app too?

Cheers,

Nigel

Hi Nigel,

Yes this is correct behavior.

We have not "forced" any version 8 installations to upgrade to version 9. We still support version 8 and will continue to release security patches and protection updates for several more months.

Users can manually upgrade themselves by downloading and running the version 9 installer.

Thanks, Bob - useful to have that confirmation!

I've now done the manual update to version 9....

---

nigelh wrote:

I've now done the manual update to version 9....

---

Glad to hear it, please let me know how it goes.

---

bobcook wrote:

The headline feature for version 9.0 is Web Protection, offering protection to make web browsing safe. This is the same technology used by our corporate customers, learn more from our website: http://www.sophos.com/en-us/why-sophos/innovative-technology/web-protection.aspx

---

That link redirects to http://www.sophos.com/en-us/products/next-gen-firewall which seems to be for a hardware firewall.

Can you tell us a bit about the Web Protection in the Mac application? Is it a blacklist type of blocking?

Hi Bob,

Re version 9: it goes well. No problems or issues to report at all. I've so far used it to do a full scan on my MacBookPro and on a MacMini, in both cases finding no threats.

Whilst using Safari on the MacMini, accessing a rogue website - viooz.co - Sophos immediately detected that it was a bad site and blocked all attempts to access it. Oddly, though, we had previously used that site - to watch the end of a film that our recorder chopped off! - and it didn't seem that it caused any issues, when I subsequently installed Sophos and did the full scan. Maybe it all depends on which links on that site one actually clicks on?

Incidentally, if one encounters a blocked site, is there any way to override the block and access it anyway (however inadvisable that might be)? I couldn't see any way to do that.

Nigel

PS I also posted a question and a couple of suggestions for enhancements, a couple of weeks ago, at:

http://openforum.sophos.com/t5/Sophos-Anti-Virus-for-Mac-Home/Scan-Local-Drives-filenames-only-show-intermittently/m-p/13236/thread-id/6238

but I didn't get any reply as yet?

---

FrMFX wrote:

---

That link redirects to http://www.sophos.com/en-us/products/next-gen-firewall which seems to be for a hardware firewall.

Can you tell us a bit about the Web Protection in the Mac application? Is it a blacklist type of blocking?

---

Sorry about that, our website reorganization has retired the nifty video that explained it.

The web protection for the Mac is a two-part process:

(1) send the URL (without any personally identifable information like query strings) and IP address of the remote server to SophosLabs; their servers return a "thumbs up" or "thumbs down" about the server your Mac is trying to connect to. This is sort of like a "blacklist" but a really big one that is dynamically maintained by SophosLabs based on their view of the web, and spam traps, and analysis of malicious or suspicious software.

(2) scan the content returned from the remote server with our threat detection engine, looking for malcious downloads and it also inspects HTML pages and Javascript that might try to trick your browser into showing you content that is suspicious looking e.g. iframes that try to redirect your browser to bad servers, etc.

Hope that helps, please let me know if you are looking for more detail.

Hi Nigel,

Glad to hear v9 is working well for you.

The web is a very dynamic beast - sites get compromised then cleaned up rather quickly. If you want to ask SophosLabs to review a specific site after you've been blocked, please use this "self-service" page: https://www.sophos.com/en-us/threat-center/reassessment-request.aspx

Note this will put the site into a queue for review. Its not going to give you an answer right away. There is a lot of automated site testing that happens behind the scenes in SophosLabs, your request might not even be seen by a person.

If you are really sure you want to allow access to the site, even without any feedback from SophosLabs, you can enter the domain or IP address into the Preferences, Web Protection, Allowed Websites list.

 From the help manual...

Sophos Web Protection provides enhanced protection against web threats. It works by looking up website URLs in the Sophos online database of infected websites, and then blocking access to any websites that are known to host malware.

Supported Browsers

The following browsers support web protection:

• Firefox

• Google Chrome

• Safari

• Opera

General Settings

Web Protection can be configured to block access to malicious websites, scan downloads to help protect against malicious content, or both.

I also found this: 

youtube video

I just did the upgrade to version 9, running os x 10.9 (mavericks GM seed).  (yep, I know, I still thought you might be interested).

During install and initial start up, I got an error message saying that a kernel extension was from an unknown author, but that it would be loaded anyway.

It did install and seem to run, although autoprotect was off.  I asked it to update, and it is now in a very long downloading cycle, with InterCheck smashing my CPU.

Thank you again for offering this to the Mac community, and for free at that!

Rick.