Sophos Endpoint Security and Control for Windows (also known as Sophos Anti-Virus) is a security application that provides a number of features for computer systems running Microsoft Windows, in particular protection against malware such as viruses.
These instructions are primarily for people who want to install the Sophos software onto their personal laptop and/or desktop. Please check with your local IT Support Staff about antivirus protection for college and departmental systems as local arrangements often apply, and installing the version intended for personal systems may cause problems.
- Make sure that your computer is running a supported version of Windows. The current version of Sophos Endpoint Security and Control is version 10.0 which is supported on the following desktop operating systems including 64 bit versions where applicable.
- Remove any other anti-virus software installed on your machine. To do this use the
[Programs and Features]control panel (Windows 7 and Vista) or the
[Add or Remove Programs]control panel (Windows XP).
When you download the installer you may receive a warning that the program may harm
your computer because it is not commonly downloaded. This is normal if you use a recent
version of Internet Explorer, for example. You may need to click on
Actions before you can run the installer. When you click on
Actions you will see a Smartscreen Filter window. The Sophos
installer is now digitially signed; click on the entry against Publisher to see
the details. To run the installer you will need to click on
This section describes how to install the Sophos software once you have downloaded it from the OUCS Self-registration page.
The installation of Sophos onto your computer is an automatic process. Once you have started the installation please be patient and wait for it to complete (this may take several minutes). You are not required to help in this process. To begin with you will see the following screen while the program is installed:
If the installation has failed for any reason the shield will be red. If this happens please refer to the Frequently Asked Questions (FAQ) web page for information on how to find out what the problem is.
This will open the
Notification Area Icons control panel. Look down
the list (and if necessary scroll down) until you see the entry for
Endpoint Security and Control]. From the drop-down list next to it change the
[Show icon and notifications]. Finally click on
OK to apply the changes.
So long as the shield is blue and white as shown then Sophos should be working correctly. However you still need to update it as described below to protect against malware discovered since the installation package was built. If the shield looks different, such as shown in the following picture, please refer to the Frequently Asked Questions (FAQ) web page for explanations and possible solutions.
Sophos generally pops up status messages from the shield to alert you to problems, as well as to confirm that Sophos is running properly. For example, after you start up your computer you may see a message telling you that all protection is enabled as shown below.
blue and white shield shows that Sophos is installed and
running properly you still need to update it immediately to
make sure that it can identify the most recent viruses. Before you update Sophos make
sure that your computer is connected to the Internet.
Once all the necessary files have been downloaded, Sophos will automatically install these files onto your system. At this point you will see an installation progress screen. While Sophos is updating the Sophos shield near the clock may disappear for a short time.
Once the files have been successfully installed, the installation screen will close
Sophos shield icon in the task bar should be visible and
blue, and any progress boxes will close indicating that the update is complete.
From this point on Sophos will try to update itself automatically every hour. You won't see the downloading screen during these automatic updates. See the Keeping Sophos up to date section below for more information on auto-updating.
Once installed Sophos should automatically check files that you open for viruses. To
open the main Sophos program itself, if you need to run scans, modify configuration or
manage items in quarantine, open Sophos EndPoint Security and Control from the
[Start] menu (in the Sophos program group, or right-click on the
shield in the task bar and select Open Sophos EndPoint Security and
Sophos Endpoint Security and Control uses a username and password to automatically download updates. These credentials are valid for around 14 months and expire during November each year. Once they have expired, Sophos will no longer be able to download updates, and your computer will be more vulnerable to new viruses etc.
This normally only applies to Sophos installed onto personal laptops and desktops. On college or departmental systems, Sophos (or other antivirus software) is often managed by your local IT Support staff and you should check with them before making any changes.
To make sure that you keep your computer(s) up to date, you will need to download and install a new Sophos package in October each year. Please see the Frequently Asked Questions (FAQ) for more details on how to check whether your installation(s) of Sophos is using valid credentials.
On computers that are connected to the internet Sophos will check for updates once an
hour. To find out when the program last updated itself, hover your mouse over the
blue and white shield icon found in the task bar and you should see a
small pop-up window showing the date and time of the last update:
If you find it difficult to make this status message appear you can see the same
information by right-clicking on the shield and choosing
[Open Sophos Endpoint
Security and Control] from the menu. This will open the Sophos program, and the
main screen will show a
Status box near the top left of the window.
While Sophos is updating you can choose to view a progress window. Do this by
right-clicking on the shield and choosing
[View updating status] from the
menu that appears. The option will be unavailable if Sophos isn't updating.
If you see a red circle with a white cross superimposed on the blue and white shield (see below), the most recent update failed. This will always happen (and is normal) if Sophos tries to update while your computer is disconnected from the Internet. If your Internet connection is working correctly and the update fails, refer to the Frequently Asked Questions (FAQ) for some possible reasons and solutions.
- Clean up virus-infected files. If this fails it will move them to a special
C:\Documents and Settings\All Users\Application Data\Sophos\Sophos Anti-Virus\INFECTED(Windows XP) or
C:\ProgramData\Sophos\Sophos Anti-Virus\INFECTED(Windows 7 and Vista).
- A weekly full scan of your C: drive is scheduled to run at 21:00 on Wednesdays.
- Web Protection is enabled
If you wish to change any Sophos client settings you may do so. This section covers some common configuration changes including configuring and running manual scans. For full details, refer to the built-in Help in the Sophos EndPoint Security and Control program.
Open Sophos and you will see the following screen. Note particularly the greyed out
Home button near the top of the window under the
menu. You can use this button from other Sophos screens to return to this main
The options on the
Scanning tab control whether on-access scanning is
enabled together with when Sophos will check files (i.e. on read, on write etc.). For
version 10 of Sophos files are checked On read, On write and On
The Scan for section of this tab specifies what type of malware Sophos checks
for. By default Sophos is configured to scan for malware including viruses but will not
check for Adware and PUAs (potentially unwanted applications) or Suspicious
files. This is because some legitimate software can be detected if these options
are enabled. Enabling these options is more thorough but may also detect legitimate
software. If you do want to enable them we recommend that you first do a manual scan of
your computer for Adware and PUAs and/or Suspicious files. You can
then authorise any any legitimate software that is detected as supicious or a
PUA before you enable detection of these files via On-access scanning. To authorise
legitimate software use the
[Anti-Virus/Authorization...] option on the
Sophos provides automatic on-access scanning which gives you constant protection against viruses in any files, emails etc. that you are actually using. In addition, you can perform on-demand scans of either your whole hard disk(s) or just selected sections.
On-demand scans can be run manually, or you can schedule them to run at a particular time and on particular days of the week. The preconfigured package provided is configured to run a scan every Wednesday at 9pm. You can't edit this scan but you can delete it and set up your own scan.
From here you can choose what files or folders the program will scan for you. In this
example on Windows 7, Sophos has been configured to scan
Documents. In the Scan name box, add a name e.g.
Next, select the
Configure this scan option near the bottom of the
window. A new window,
Individual scan settings, will open. The
Cleanup tab will allow you to specify what Sophos does it it finds any
malware. The options on both the Scanning and the Cleanup tabs are
very similar to those outlined in section 2.1. General Sophos Settings.
Saved scans can be scheduled to run automatically on your machine. NB. You cannot save a scheduled scan if you do not have a password set to log on to your machine. For advice on passwords and password security please see the OUCS Password pages.
- From the
Available Scanslisting on the front page, open a saved scan by selecting it from the list and then clicking on
Edit. The scan configuration page will open.
- Click on the
Schedule this Scanoption near the bottom of the window.
- A new screen will open. Initially all options are greyed out, but these are
enabled by clicking the
Enable schedulecheckbox. Sophos adds default values when this is first enabled.
- The scan will run automatically at the day and time specified. Note that if your computer is turned off at the time when the scan is supposed to run then it simply will not run.
To run the general virus scan, return to the main Sophos window (use the
Home button under the
[Help] menu) and select the
Scan my computer icon. This will immediately start a full scan of your
To run a saved scan, select the
Scans option on the main Sophos window
to view the list of available scans. Select a scan from the list and then click on the
Start button. Note that you cannot do this for the preconfigured
Wednesday 21:00 scan.