Antivirus software from Sophos Plc, Abingdon, Oxfordshire, England (www.sophos.com) that runs in a wide variety of environments including Windows, Mac, Linux, Unix, NetWare and Network Appliance storage systems. Used worldwide, Sophos is noted for its fast performance.
Scan Once and Create a Checksum
Instead of scanning for all virus signatures each time a file is opened, Sophos performs a full scan on the file one time. If the file is free of viruses, Sophos creates a checksum for the file that it stores in a database. The next time the file is opened, Sophos recomputes the checksum and compares it against the stored checksum. If they match, the file has not been altered. A non-match means the file has been changed, and a full scan is performed against the file.
Computing and comparing a file's checksum is considerably faster than matching the file against the huge volume of virus signatures that only continues to grow. See
virus.
Sophos Vs. Regular Method
As can be seen in this illustration, it takes a lot more time to match a file against all known virus signatures than it does to recompute a checksum and compare it. The full scan has to be performed once in the beginning in order to determine if the file is free of viruses.
