Sophos Detecting EICAR with NET IQ WebMarshal Installed

  • Article ID: 15879
  • Rating:
  • 2 customers rated this article 1.0 out of 6
  • Updated: 05 Nov 2011

Issue

Eicar.com test virus keeps being detected by the Sophos On-access scanner when the WebMarshal console tries to be opened. Can prevent internet access for rest of network. Turning off the on-access scanner allows console to open.

or

When opening the WebMarshal Console an error occurs...

Unable to connect to LocalHost: 0x0080005 - Server execution failed.

An error occurs in the Event Viewer application log. 

Failed to create Eicar.com test virus file. This typically happens because a virus scanner is operating.

First seen in

Sophos Anti-Virus for Windows 2000+ 9.7.5

Cause

WebMarshal version 2.1 and onwards supports virus scanning of uploads and downloads using either Sophos AntiVirus, Norman AntiVirus and Marshal Integrated McAfee.

WebMarshal uses a temporary directory during virus scanning and this directory must be excluded from any resident virus scanning. By default, this directory is the temp directory located off the WebMarshal directory (e.g. C:\Program Files\Marshal Software\WebMarshal\Temp\).

What To Do

Ensure that the WebMarshal\Temp directory (e.g. C:\Program Files\Marshal Software\WebMarshal\Temp\) is excluded from scanning by the on-access scanner.


 
If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent

Comments