sophos 3.67 and wrapper script

[Nerijus Baliunas]

As it was already reported here, disabling these four options makes
scanning even slower. You can report it to Sophos.

> On Mon, Mar 17, 2003 at 09:58:17PM +0100, Willem Kuiters wrote:
> > > Their new engine is appallingly slow to start up, and the more people that
> > > complain about it, the greater chance of them actually fixing it.
> >
> > Many thanks, that solved it. I installed the XRS version and your new
> > scripts. I'll write a complaint about the performance problems of the
> > 3.67 engine now.
>
> Here is their reply:
>
> Willem.
>
> The reason for the slow down in performance is the increased detection
> rates for certain files.. if you wish to turn this off then please look at
> eth following document...
>
> This message is about slow-downs in scan speeds that may be reported with
> SAV v3.67 on Unix platforms.
>
> Version 3.67 of Sophos Anti-Virus on non-Windows platform sees a big jump
> in engine capabilities. In particular it contains plug-ins enabling
> thorough scans of four common file types - pdf, rtf, elf (Linux/BSD
> binaries) and .class (java 'executables').
>
> The addition of these plug-ins means that the engine is doing more work to
> provide better protection.
>
> As a result of this some customers may report significant increases in the
> time taken to scan their filesystems. Increases will vary according to the
> number and proportion of the file types mentioned above. The extreme
> example is scanning a set of files consisting solely of pdfs, rtfs, elf
> binaries and java files. In this case the scan time increases by a factor
> of just over 3 (60 minutes -> 195 minutes).
>
> The important thing to remember is that the slowdown is due to the
> increased level of protection that we need to provide given the continuing
> growth in the number of different file types that can carry viruses.
>
> It is possible to disable these four options when using sweep by adding the
> following command-line arguments:
>
>   -nopt=Pdf
>   -nopt=Elf
>   -nopt=Rtf
>   -nopt=Java
>
> Don't forget that use of any of these options may seriously impact our
> ability to detect viruses in those types of file.
>
> Part of the speed reduction appears to be due to the internationalisation
> that was also introduced in v3.67. We are looking into that and other areas
> of concern and hope to be able to offer some performance improvements
> without compromising security in the coming months.
>
> Stephen Higgins
>
> Technical Support Engineer