Home Forums FineTunedMac Community Lounge Why did you install Clam?

Hal, for some reason or other, you seem to be taking my posts a tad too seriously - or misinterpreting them. I'm not claiming that SophosAV is total snake oil - it's clearly not. But equally clearly, the need for it is still largely a marketing ploy. That's what I object to, and that's what I've tried to point out. If people want to run it, that's their choice, but I hope they're doing it with their eyes wide open - clear that (a)there is still no compelling need for AV software to run in the background on a Mac and (b) free may not stay free.

As for linking to MacNerd's post, that was simply because his was the last post in the thread at the time and I'm not used to board software that links directly to just ONE person's post - none of the other two Mac boards I participate in actively use this board software. My apologies if I confused things. MacNerd does point out that the SophosAV found 3 Trojans and 2 spyware/malware "things" in his Java cache files that weren't found by ClamAVX. He also indicates that he's not sure they were in fact malware, or whether Sophos just identifies them as such. Without knowing what they were called, it's a little difficult to respond to that. At any rate, running Onyx and asking it to clear out the Java cache will be just as effective, no? Or just dump that cache file by hand... (Assuming here that we're talking about files that are in fact only harmful to Windows users). Anyway, perhaps I appear to have come on as rabidly against SophosAV - that was not really my intention. What really bothers me is the marketing that goes on to convince people that they really need stuff they really don't by scaring them. Anti-bacterial hand cleaners fall into the same category. (actually, they're far worse, but that's another topic entirely...) CDC - Antibacterial Household Products: Cause for Concern

I've also taken Sophos for a spin around the block, installing it several days ago. I did two scans, including the "look in every compressed folder" scan (not for the faint of heart - took about 8 hours).

It didn't find anything.

I've been using ClamXav and, when I first installed it, it found two or three things (I can't recall what they were) which it put into the Quarantine folder and I threw them out. I suppose that's why Sophos didn't find anything.

I've left them both installed and they don't seem to care, although periodically they switch places on the menu bar.

I'm going back to just ClamXav.

ryck

Ryck,
Just curious: did you install Java 6.0 prior to scanning?

Good question. It has forced me to think a bit about the sequence of events, and actually raises another question. The answer may mean that I'm not being overly helpful.

I would have installed Java 6.0 prior to scanning with Sophos, or the ClamXav scan that found some things but which I couldn't recollect.

Did the ClamXav scan, which was first, remove them from the Java 6.0 cache folder? I now have no way of knowing so, I may have had a similar issue as you but I can't confirm.

ryck

A little update. Just used ClamXav to scan my HD on work computer. The default options were only for home folder (users/yourname), Documents and Desktop. The scan analyzed only 14,000 files out of 595,000. At the same time, Sophos home edition scanned the whole hard disk. This makes me think that it is far superior than ClamXav.
Another thing about Java. Looks like malicious files on the home computer were acquired, because the work computer running 10.5.8 had all Java 6.0 cache folders empty even before I scanned with ClamXav.

Good point. I also did a complete disk scan (1.8 million files) that took more than 8 hours. It would likely have been much shorter if I had unchecked the "Scan archives and Compressed Files". If I thought it would take 8 hours every time I'd head for the hills.

However, it's pretty easy to create specialized scans so I'm going to give Sophos a longer tryout and have, for now, removed ClamXav.

ryck