Disabling scanning for Windows malware

Question

Is there a way to keep the Free Anti-Virus for Mac from scanning for Windows malware? This is not a concern for me, and I don't want to waste time and system resources on looking for malware that does not affect me (Note: I do not care about the possibility of spreading malware to Windows users).

This thread was automatically locked due to age.

Agile · Accepted Answer

The fact that this product -- Sophos Anti-Virus for Mac -- scans for Windows malware at all, is ridiculous. That you can't disable that functionality is utterly nonsensical. Using your logic, why stop at Windows? Why not add malware detection for every operating system on Earth into Sophos Anti-Virus for Mac just in case?

Actually, this is Sophos Anti-Virus for Mac -- as advertised, it is the same detection engine used for all Sophos products. What this means is that it has added malware detection for most currently used (and many legacy) operating systems. It detects Linux rootkits, the one Apple // virus, and many others. This same engine runs in Sophos AV Enterprise for Mac, Windows, Windows Mobile, Unix, Linux, NetWare, OpenVMS, NetApp Storage and MS Sharepoint.

The benefit is that anyone running a mixed environment knows that they can have the same protection in all environments, and they don't have to worry about receiving or spreading viruses. Since you're not concerned about infecting others, this isn't an issue for you. However, for businesses (Sophos' paying customers), this is extremely important. Many home users also feel it is important to them.

I understand you don't want to be downloading detection packs for detections that will never trigger on files that will negatively affect your computer. You also don't want the engine having to traverse through these other detections when your CPU could be doing something else.

However, what do you consider a Mac detection? The SAV engine detects malicious activity, which includes malicious iFrames on web pages, Java-based downloaders (even ones that we don't know whether the payload being downloaded is Windows-centric, Mac-centric, or something else), malicious PDFs (once again, they usually download other content), Office Macro viruses (which have had an on/off relationship with being harmful to Mac Office products), etc.

So are you just saying you don't want to detect Windows Executable malware, all this other malware, or some subset? Or are you suggesting that the data packages you download should be fine grained enough so that you can say "Download anything Mac/, OSX/, PDF/ MSO/?" The problem with this is that detection often doesn't think about the filetype it's in; it looks for functional behaviour in the code -- which means that a Mal/ written for Windows XP could at some point end up detecting malware targeting another system. Turning this off means you'll never detect it on your Mac, even though the product is fully aware of the issue.

Malware has come a long way since the 90's -- and so has detection. We aren't talking about checksum-based detections for specific files here, nor codestream-based detections. Sure, both of these are used when appropriate, but they're only a couple of tools in a large detection toolbox. A lot of malware bits are interrelated, and ignoring one bit because you think it won't affect you can result in an entire detection chain failing to protect you.

This also means that if you're imagining a huge datafile full of Malicious Windows checksums and SAV walking through this list, eating up memory and CPU time on your computer, this isn't what happens. The product intelligently checks its environment and what kind of file it is scanning, and scans appropriately. In a worst-case scenario (such as a JAR file embedded inside a zip file embedded in a dmg all sitting on a Time Machine volume with multiple revisions), you will see some slowdown as all the variations are unpacked and examined, but for regular on-access scanning, this won't provide much of a slowdown compared to mac-only scans. You do see the difference on on-demand scans, but you should only have to scan on demand once if you've got on-access enabled.

All this being said, the total coverage aspect of Sophos Anti-Virus is what makes it unique among free Mac AV software. Which means, if you don't want the added coverage, there are other pieces of software out there that will serve your purpose by only targeting mac-specific malware.