Event description: Malware not cleaned up: 'Troj/HkMain-AY' at '/Users/xx/Library/Mail/V2/ExchangeIMAP-xx/Public Folders.mbox/Info and Enquiries.mbox/4072A343-E9D4-47C3-9694-8E4B7C1CD48C/Data/3/7 /1/1/Attachments/1173794/2/INV211457.zip'

Ah yes the perennial question viruses don't affect Macs so why worry.

(We will ignore the fact that while there are no Mac viruses there is some Mac malware.)

The answer is that while we generally don't need to worry about our own Macs, we do need to ensure we do not pass them on to poor old Windows users. If we did do so it would potentially affect our reputation with our customers.

Oh, sorry, didn't mean it as an insult. I actually tried to be a bit funny and forgot the smiley Embarassed

I would be surprised if sophos could really find mac viruses/worms/whatever anyway.

I must admit I can't remember if I compared them then, but I have just now and the version of the Sophos Engine and virus database version reported in Kerio Connect and the desktop (Mac) version of Sophos are currently identical. So there is absolutely no reason why they should be so different in ability to detect viruses.

1. The integrated antivirus scans emails on delivery. It may therefore happen that the infected email is delivered at a time when the definition of the virus it not yet known. The same virus can be detected later by another antivirus (or by the same antivirus, try e.g. sending the email to yourself) because its definition has become known in the meantime. (Unfortunately, the scan on the server cannot be postponed until the user actually wants to view the email.)
2. Sophos recently added on-line queries for suspicious files to the standalone versions their antivirus. We plan to add similar functionality in an upcoming version of Connect.

Only Kerio or maybe Sophos can tell us if the embedded Sophos does scan zip files.

Scan results should be the same with the same engine and virus definitions. However, there can be a difference in the time when the scan is performed wrt when the virus definitions become available:

1. The integrated antivirus scans emails on delivery. It may therefore happen that the infected email is delivered at a time when the definition of the virus it not yet known. The same virus can be detected later by another antivirus (or by the same antivirus, try e.g. sending the email to yourself) because its definition has become known in the meantime. (Unfortunately, the scan on the server cannot be postponed until the user actually wants to view the email.)