I'm not sure how many people on the list are aware that Sophos is currently Beta testing a new version of SAV for Linux (5.0) which includes on-access scanning. More information on it can be found here http://www.sophos.com/products/es/beta/sav-linux/ .