Anti-Virus Software - guilty or not guilty?

[kennysarmy]

I am guilty.

 

Guilty of sometimes forgetting that; Sophos is installed on a server, it's pushing updates out to clients, the clients are blocking threats and I should check the console more often....

 

What I struggle with though is Sophos blocks a threat, say an autorun.inf file from a USB stick and by the time I do check the console they have logged off and the threat is no longer cleanable and the machine stays in the logs as having an alert. How do others cope with this?

 

Jeff

[sted]

if its something on a pen drive then i just chalk it up as one of those things short of searching everyone in school for pen drives and scanning them all there is as far a i can see not a lot you can do (unless its on a staff laptop so you can make an educated guess who it is)

[kili]

Most of our cleanable threats are in the temporary Internet files folder which group policy deletes when users log off, hence Sophos reports the threat as unclean-able. I just click the erros link highlight them all select "resolve errors and alearts" and click acknowledge. Not to much trouble I check every day so they dont build up. Just get used to a routine of once a day checking whats going on with your Enterprise console as you need to ensure that your console is being updated by your root update server on a regular basis.

 

kili

[X-13]

What I struggle with though is Sophos blocks a threat, say an autorun.inf file from a USB stick and by the time I do check the console they have logged off and the threat is no longer cleanable and the machine stays in the logs as having an alert. How do others cope with this?

 

Jeff

 

Let me just preface this with the following disclaimer:

 

I haven't looked at Sophos is a long time, so I may be wrong on this.

 

 

 

Wouldn't it be possible to set Sophos to disable USB drives until they're scanned, scan on insert and auto-fix problems*?

 

 

*If unfixable, disable USB and issue a message saying "Your USB drive has been disabled. Contact I.T to discuss your options."

[joe90bass]

Let me just preface this with the following disclaimer:

 

I haven't looked at Sophos is a long time, so I may be wrong on this.

 

 

 

Wouldn't it be possible to set Sophos to disable USB drives until they're scanned, scan on insert and auto-fix problems*?

 

 

*If unfixable, disable USB and issue a message saying "Your USB drive has been disabled. Contact I.T to discuss your options."

 

I asked Sophos something similar a while ago, appaently it's not feasible due to the size of flash drives and portable hard disks these days

[X-13]

I asked Sophos something similar a while ago, appaently it's not feasible due to the size of flash drives and portable hard disks these days

 

 

That would entirely depend on how much of the space is actually being used.

 

A 2TB external HDD with a single 1kb .txt file on it will take all of a second to scan.

 

 

Likewise, a 4gb USB filled to capacity with various images, documents, .MP3 files and videos will take longer.