Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 27 replies
  • Subscribers 6 subscribers
  • Views 70531 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Version 9.4.0 Preview Now Available [Update: release candidate build published today]

bobcook

We are working on a major new revision of the Sophos Anti-Virus Home Edition in the near future, and we’d like to get your help with evaluating it. This software has passed all of our internal testing but its always useful to get feedback from real users.

New features in this version:

  • Detection and cleanup of Potentially Unwanted Applications (adware, spyware, and certain remote access tools fall into this category)
  • Updated Quarantine Manager user interface
  • Faster Web Protection filtering component
  • Security and stability improvements


We invite to have you download and install this “preview” update to your Mac. Start by downloading the installer here:

http://www.sophos.com/Pages/DownloadRedirect.aspx?downloadKey=8579BC43-753D-48D0-8C74-60593FEB7097


SHA-256 hash: a4b78abdc4cea2bc212aa1b740c3b2229316b7cdb2509e7f2a307cf1f1c36735

When you run the installer it will install version 9.4.0b1. If you have an existing installation it will upgrade your software to version 9.4.0b1.

You can then enable the detection of PUAs in the On-Access preferences panel. These applications will be blocked from running automatically. Its possible we will detect tools that you are using as part of your daily routine - if so you can “authorize” their usage from the new Quarantine Manager window. You can later undo this choice by visiting the Authorizations preferences panel. Custom scans can also detect and optionally clean up PUAs when detected. Check out the Options tab for each scan.


Things to know about this build:

  • It's passed all of our internal testing, including the same level of protection from malware as the existing version (9.2.7)
  • It's beta, and therefore you should know that its incomplete e.g. only the English user interface is available today and the documentation isn’t updated yet
  • This build isn't yet ready for use with Mac OS X 10.11 El Capitan, but we will be ready in the near future - watch this space for details


Your feedback is appreciated, as we’d like to uncover any lingering issues before general release.

Not happy with this version? You can download the 9.2.7 installer from our website and run it to downgrade your install. If you do, please let us know why.

[UPDATE 27th AUGUST]

We published the release candidate build today, all existing 9.4.0b1 installations will automatically upgrade. Check your version number, it should say 9.4.0 (no more "b1"). We made a number of improvements, bug fixes, tweaks, etc. to this build and looking for more feedback. Some highlights:

  • compatible with the System Integrity Protection feature on Mac OS X El Capitan 
  • the Quarantine Manager has a different appearance when empty (should be more obvious about how the new QM works)
  • faster boot times due to cacheing of previously scanned system files
  • more reliable updating code when the network condition is less than ideal (you might have heard about this issue in these forums)
  • translations for a few languages other than English

Please let us know if you run into any problems or issues. The same installer link above will still give you 9.4.0b1 but its first update will get you to the new build.

:1021401


This thread was automatically locked due to age.
  • 0
    catnip689 wrote:

    As happened with the previous version, the new version worked for a day or two now won't stop downloading on iMac with Yosemite, can't even cancel the download.

    Weird. Not heard of this type of issue in a long time. Can you get a sample of what the "SophosAutoUpdate" process is doing when its stuck like this? You can get one via the Activity Monitor. Switch to view all processes, find SophosAutoUpdate, and select "Sample Process".

    You can kill SophosAutoUpdate through Activity Monitor as well.

    I'm also be interested to get a network trace of what SophosAutoUpdate is doing when it gets stuck. Assuming its a reproducible problem (sounds like it is) then start up Terminal and run this command:

    sudo tcpdump -i en0 -w ~/Desktop/sau-capture.pcap port 80

    Note that command assumes your external network interface is en0. And this command will capture *all* HTTP traffic when its run, so be cautious about what you are doing when you run the capture command. I recommend stopping your web browser before stating the capture.

    When the capture has finished, press Control-C then find the file on our desktop. You can send it to me directly, or post it here. Note that anything you post here can be read by pretty much the entire world.

    :1021516

    ---

    Bob Cook (bob.cook@sophos.com) Director, Software Development

  • 0

    Using Sophos 9.4.0 preview with System Integrity Protection turned off in El Capitan beta 6, the temperature rising in my 5,1 Mac Pro shortly after boot tipped me off to check Activity Monitor. With 6 cores and 12 threads available, Sophos InterCheck was using nearly four of them (380.6% CPU). The other Processes were mostly mdworker, mds and mds_stores and they were all under 5% utilization. I haven't seen usage like that with the release version of Sophos. Is that some new feature at work?

    :1021532
  • 0
    ZRL1 wrote:

    Using Sophos 9.4.0 preview with System Integrity Protection turned off in El Capitan beta 6, the temperature rising in my 5,1 Mac Pro shortly after boot tipped me off to check Activity Monitor. With 6 cores and 12 threads available, Sophos InterCheck was using nearly four of them (380.6% CPU). The other Processes were mostly mdworker, mds and mds_stores and they were all under 5% utilization. I haven't seen usage like that with the release version of Sophos. Is that some new feature at work?

    Its not anything we specifically added. That does seem suspicious. I haven't seen that in our own testing so far, but its something I'll get the team to look at specifically. Thanks for the info!

    Curious - have you tried the PUA detection and authorization workflow? Its not precisely the same user workflow as our Windows endpoint product, so very interested to know whether we've made the right design choices.

    :1021534

    ---

    Bob Cook (bob.cook@sophos.com) Director, Software Development

  • 0
    bobcook wrote:
    ...Curious - have you tried the PUA detection and authorization workflow? Its not precisely the same user workflow as our Windows endpoint product, so very interested to know whether we've made the right design choices.

    Hadn't tried it yet so I just tried it now, in a Yosemite Virtual Machine snapshot. I'd say it works quite well and the interfaces that pop up give helpful but not overwhelming information. My VM screen size is only 1600x1200 so the windows get a bit crowded, especially since the browser which makes the download connection fills a good portion of that screen, but the warning windows come forward, which is a good thing.

    In my case, a portion of the file had made its way to my desktop before the download was blocked (I'm using Firefox so the download screening is browser-independent) and was visible.  I tried that a second time while running a full HD scan and it seemed not to slow down at all while again catching the PUA. One wrinkle is that Firefox was still asking me what I wanted to do with the file when Sophos caught and stopped it and then deleted it; the FIrefox dialog box with the choices was still open. As a test, I switched the option from opening with TextEdit to saving the file and clicked OK. The file appeared briefly on the desktop and then disappeared, presumably caught and deleted again by Sophos, but this time around there was no further notification. Since most people save downloads to the Downloads folder, it wouldn't be immediately apparent what happened. It's possible users would worry that the inadvertent download made it through the second time without being caught, though the Sophos log shows the capture and delete worked again, just not with the notifications.

    The PUA intercept is definitely a valuable new feature.

    BTW, I managed to take a screen shot of the Activity Monitor window with the high CPU usage I'd mentioned and I'll email it to you shortly.

    :1021540
  • 0 in reply to ZRL1
    One other point on 9.4.0; I normally force updates (Update Now) using that menu item in the Sophos menu in the menu bar. The AutoUpdate Status window opens immediately below the menu, which makes it convenient to close the window when the update (which usually takes seconds) is done and is out of the way in the mean time.

    With 9.4.0, the AutoUpdate Status window is positioned near the left side of the screen, which tends to be in the active work area when the screen is large (2560x1440 is what I'm using).
  • 0
    When a final release is ready, will it update seamlessly, as past updates to the 9.2 have? Or will it be necessary to install in some other way, or from a separate link?
  • 0 in reply to brvx
    Hi brvx,

    The update will happen automatically, you won't need to do anything special.

    The first step will be to upgrade the 9.4.0 Preview to the final build (including El Capitan support). Watch this thread for more details coming soon.

    In September we'll upgrade the existing 9.2 version as well, everyone will get it automatically too.

    ---

    Bob Cook (bob.cook@sophos.com) Director, Software Development

  • 0

    Before the new forum ate recent messages I was have a conversation with Bob Cook about the following Scan Log message:

    "Corrupt file: /Users/Specimen/Library/Containers/ca.kirara.poison.next/Data/Library/Mail/V2/IMAP-XXXXXXXXXX@imap.XXXXXXXXX.com/INBOX.mbox/D9B113E3-D5A6-4B54-A803-3DE2DB8A1676/Data/9/5/Attachments/59424/4/XXXXXXX.doc" (I redacted all personal information from the path)

    This file is actually an alias to the original file, but it was the only alias that Sophos flagged, and Bob suggested I check the checksum of the alias and the original.
    And I have checked (using shasum) and they give the exact same checksum.

    So, it's still unclear why Sophos is specifically flagging this file (as it did not flag the original as a Corrupt file).

  • 0 in reply to bobcook

    Hi Bob,

    I just noticed that the 9.4.0 beta got a 35+MB update when I initiated "Update Now" and the beta symbol has been dropped. Is that now the release version for beta testers and/or the final build?

  • 0 in reply to ZRL1
    Hi ZRL1,

    You are faster than me to the forum! Yes we released the final build today for testing. I'm going to update the top post to reflect that.

    ---

    Bob Cook (bob.cook@sophos.com) Director, Software Development

Unfiltered HTML