Advisory: High CPU utilization on Linux / Unix systems when using Virus Data 4.71

Products Affected
Sophos Anti-Virus for Linux/Unix 7.4.0+
Sophos Anti-Virus for Linux/Unix 4.71+

Sophos is aware that some customers running Sophos Anti-Virus for Linux and UNIX may have noticed a significant increase to the CPU cycles. We have traced the cause to changes made in the virus data (version 4.71) released at the end of October 2011, following a change to script classification. It appears that this has had a particularly adverse impact on Linux / UNIX platforms due to the log file behaviour, which causes high CPU use when running on-access scanning.

Sophos has been treating this incident with high priority, and formed a dedicated team to solve this quickly. A new virus identity file gwelog-a.ide was released on Thursday 19th of January at 13:49:33 PST which we believe will resolve the issue and provide significant performance benefits for affected customers.

Customers who still encounter performance/CPU problems with this new identity file are advised to contact Sophos Technical Support for further assistance.