Screenshots at http://www.wuala.com/grahamperrin/public/2010/11/03/d
- shots 001 and 002 show false negatives.
- shot 003 shows on-access detection of EICAR-AV-Test
- shot 004 shows Quarantine Manager empty moments after the detection.
The problem here is probably a Sophos process run as root.
References
http://en.wikipedia.org/wiki/Filesystem_in_Userspace
http://code.google.com/p/macfuse/wiki/FAQ in particular the default,
> superuser is denied access
This thread was automatically locked due to age.