This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Please, help me PUA On-access detection in Sophos Linux

Hi

I have Sophos Free Linux in Kubuntu 14.04 and I necessited configure PUA on-access detect but I don't success to it ( I looked manual for savconfig in terminal ).

Any secret tip ?

Thanks



This thread was automatically locked due to age.
Parents
  • For a very good reason, this is not the correct forum. This is a firewall forum.

    One of the moderators might read you request and move you to the correct forum.

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • QC said:

    Why do you want to for PUAs and which PUAs do you have in mind?

    Christian

     
    Phishings and miners.
     
    Remind savscan, in on-demand, accept -pua and -adware. Why, in on-access, not accept ?
     
    Thanks
  • Hello Henrique RJ,

    can't say why the -pua option is only available from the command-line. Perhaps can tell.

    Christian

  • Hi,

     

    There isn't any particular reason why PUA detection is only available for savscan, it was just never requested as a feature for on-access or scheduled scans.

    The PUAs we detect are (primarily) for Windows, so wouldn't detect very much on Linux.

     

    Thanks,

    Douglas.

  • DouglasLeeder said:

    Hi,

     

    There isn't any particular reason why PUA detection is only available for savscan, it was just never requested as a feature for on-access or scheduled scans.

    The PUAs we detect are (primarily) for Windows, so wouldn't detect very much on Linux.

     

    Thanks,

    Douglas.

     

     

    Thanks  

    PUAs include phishings and miners in Linux ?

  • Hi,

     

    I'm afraid I don't know for certain, but I think PUA only include Windows programs, such as Adware.

     

    Thanks,

    Douglas.

  • DouglasLeeder said:

    Hi,

     

    I'm afraid I don't know for certain, but I think PUA only include Windows programs, such as Adware.

     

    Thanks,

    Douglas.

     

     

    But phishings and miners signatures are downloaded regularmentary in updates for savupdate.

    Why on-access don't detect it ?

  • Hello,

    [disclaimer: just observations, no inside knowledge]
    right now there are several miners in the Latest PUAs list. Miners running on Linux are categorized as Viruses and Spyware/Trojans.

    Adware and PUA for Mac OS X (like MacKeeper) detection has been added in 2015. PUA isn't AdWare, a number of legitimate software (like several programs in the Sysinternals/Microsoft PSTools collection) is classified as PUA.

    signatures are downloaded
    @Henrique RJ - signatures is perhaps not the ideal term as it elicits certain connotations (especially the one that "signatures" are independent and self-contained items that the scanner uses one after the other one a file until it either gets a hit or the list is exhausted). A detection item is part of a decision network, you can think of it as a set of instructions mostly working top down, i.e. refining the assessment, calling or branching to other items in the process. A classification as AdWare is not necessarily an afterthought. In other words, detection items aren't subdivided into those for viruses, others for Trojans, and so on.

    Christian

  • QC said:

    Hello,

    [disclaimer: just observations, no inside knowledge]
    right now there are several miners in the Latest PUAs list. Miners running on Linux are categorized as Viruses and Spyware/Trojans.

    Adware and PUA for Mac OS X (like MacKeeper) detection has been added in 2015. PUA isn't AdWare, a number of legitimate software (like several programs in the Sysinternals/Microsoft PSTools collection) is classified as PUA.

    signatures are downloaded
    @Henrique RJ - signatures is perhaps not the ideal term as it elicits certain connotations (especially the one that "signatures" are independent and self-contained items that the scanner uses one after the other one a file until it either gets a hit or the list is exhausted). A detection item is part of a decision network, you can think of it as a set of instructions mostly working top down, i.e. refining the assessment, calling or branching to other items in the process. A classification as AdWare is not necessarily an afterthought. In other words, detection items aren't subdivided into those for viruses, others for Trojans, and so on.

    Christian

     

     

    So Sophos in Linux don't detect phishings ?

  • No has any " out off " tip to make on-access detect miners and phishings ?

     

    Any secret tip or tweak ?

Reply Children
No Data