Quoting from Paul Ducklin's comment beneath Yes, you need anti-virus on your Mac.. and now it's free:
We only re-scan files on-access if either the file has changed or the anti-virus has updated since it was last accessed. … know when a file changes, because our kernel driver monitors file system access, read and write, and we know how to identify each file system object uniquely. … minimises overhead, and has helped our products - on all platforms - avoid the "notorious hog" label …
Quoting from Another slowdown:
> Whenever I launch … cpu usage rockets to extremely high levels and
> … takes ages to launch
… countless .JAR files … zip files with a collection of java .class files … often thousands.
If you have archive scanning enabled in the on-access settings then the scanner has to intercept the … request for the .JAR file, uncompress it in memory, scan all on the .class files inside, and then pass back the file open request … not the quickest thing in the world as there are often so many files inside the .JAR.
Running the On-Access scanner without it scanning in archive files doesnt reduce your protection, any files accessed within an archive are scanned, and if you were to manually open, for example, a zip file its contents are scanned at this point.
I hope this helps to explain a little as to why you saw the slow down.
Puzzle
I might expect hogging just once, when an application is first launched following installation of Sophos Anti-Virus, but why should there be a sense of hogging every time that application is launched?
Does every additional virus identity (IDE) file — additions may be hourly — cause the entire contents of an .app to be rescanned when that .app is next launched?
Postscript
When I tried to reply beneath Paul's comment, the commenting system used at nakedsecurity.sophos.com failed to work with OpenID.
This thread was automatically locked due to age.
