Sophos AV doesn't block standard ClamAV test files

Question

The company where I work recently got through a security audit. Everything seems to be solid except our Sophos Cloud Security AV.

I was asked to try and download some of these ClamAV test files on our machines (in particular: clam.mail and clam.zip), expecting them to be blocked by Sophos, but instead I could not only download, but also open the files.

I tried it on my MacBook running macOS Sierra and on an up-to-date Windows 10 laptop, but the end result is the same. Sophos doesn't see these files as threats and doesn't block them.

According to the audit team, these are standard "dummy" test files that are just meant to be picked up by antivirus software, but are innocuous.

Having a look around, it seems that the standard files used in this scenario are actually the EICAR ones. Unlike the ClamAV ones, these are picked up correctly by our Sophos AV software.

We tried contacting Sophos support, but we're still awaiting a response.

In the meantime we tried the same ClamAV files on other test machines with different AV software (namely Windows Defender and F-Secure for now) and none of these pick up the threat.

Since this is the only step preventing us from passing the audit, it would be really important to understand wether it's the Sophos software that should block the files, or if the files themselves are not the correct ones to test an AV functionality.

Answer 1

Clam.exe which is used in these tests is a harmless test program similar to the innocent EICAR test virus, i.e it just prints a message. But, contrary to the also harmless EICAR this test file is not generally treated as malicious by antivirus programs and thus will not be detected. And I have no idea why ClamAV needs to have their own test program instead of the commonly used EICAR test.

Thus if Sophos detects EICAR but not the clamev.exe test program inside ZIP, mails etc you can assume that Sophos still can detect malware inside ZIP files and mails and ignore that it does not detect the ClamAV specific test program.

According to the audit team, these are standard "dummy" test files that are just meant to be picked up by antivirus software, but are innocuous.

I would question the competence of the audit team if they make such claims. Just check with virustotal and you'll find that almost no antivirus will detect this as malware.