Sophos SAV Interface
Sophos Email Security and Data Protection

Overview:
SAV Interface™ enables end users, software vendors, hardware vendors, ISPs and ASPs to rapidly integrate Sophos virus detection into their own industry-standard applications and solutions. This integration with the Sophos virus engine enables all malware to be detected, while minimal overheads make it ideal for highperformance environments.
Key Benefits
- Provides users of third-party applications with fast-track integration with the award-winning Sophos virus detection engine
- Allows compliant gateway applications to monitor email, web, and FTP traffic in real time
- Allows endpoint applications to monitor and scan fi les on demand, and as they are accessed
- Detects known and unknown threats, including viruses, Trojans, worms, spyware and adware
- Detects malware in compressed email attachments, including recursive archives
- Protects with no impact on end-user productivity
- Improves performance signifi cantly over traditional command-line virus scanners
- Enables easy integration using various methods and languages
- Alerts administrators when a virus has been detected
- Receives small (about 5 KB) updates automatically with the latest protection from SophosLabs™ a global network of threat analysis centers
- Eliminates excess memory usage by using a single, multi-threading copy of the virus detection engine to process all requests
- Includes 24x7x365 support for the duration of the license and Sophos can be contacted for one-to-one assistance at any time
Features & Benefits:
Seamless integration
- SAV Interface enables users to protect their network from viruses, Trojans, worms, spyware and adware.
- All traffic entering or leaving through the third-party application – for example, web or email traffic, including compressed attachments – is checked for malware.
- Sophos Genotype® virus detection technology proactively blocks families of viruses, and Behavioral Genotype Protection automatically guards against zero-day threats by analyzing the behavior of the code before it executes.
- Automatic malware updates from SophosLabs™ maintains the best available protection without disrupting the network.
- A choice of integration methods are available to suit all skills and programming environments.
Simplified administration
- SAV Interface requires only one copy of the virus information database to service all requests.
- There is no need for the frequent loading and re-initialization required by commandline based scanners.
- Virus protection can be kept up to date automatically.

Innovative technologies
- A range of technologies, including Dynamic Code Analysis™, pattern matching, emulation, and heuristics, automatically check for malicious code.
- Genotype virus-detection technology proactively blocks families of viruses.
- Behavioral Genotype® Protection is our built-in intrusion prevention technology. Proactively protecting against zero-day malware, it detects new threats before code even begins to execute.
- Sophos behavioural rulesets are constantly validated against an extensive library of legitimate applications, to ensure accurate detection.
- Ensures computers remain protected during updating by using “hot updating” technology.
Interface
- Choice of directly linked (SAV Interface SDK) or daemon process (SAV Dynamic Interface).
- SAV Interface SDK uses a COM-based C/C++ interface across all versions for cross-platform consistency. Third-party applications use callback functions in the SAV Interface library to interface to the virus detection engine.
- SAV Dynamic Interface provides a general-purpose interface that can integrate using any language.
Mode of operation
- Windows® COM-compliant Dynamic Link Library (DLL) or out-of process non-compliant service.
- Mac OS X: Framework.
- UNIX platforms, OpenVMS: shared library, supplied in binary form or networking APIs.
- NetWare: NetWare Loadable Modules (NLMs).
Scanning speed
- 20–30 times improvement over use of command-line scanner.
- Typical fi le scan time in normal mode <20ms.
Industry-leading expertise 24/7
- Our 24/7 customer support operation is highly acclaimed, while SophosLabs™, our global network of threat analysis centers, provides a rapid reponse to emerging and evolving threats.
Platforms supported:
- Windows
Windows 2000/XP/2003/Vista
Windows 95/98/Me and NT4 - Mac OS X
OS X 10.2/10.3/10.4 - Linux on Intel
Red Hat 5.1/5.2/6.0/6.1/7.2/8.0/ 9.0, RHEL 2.1/3/4
SUSE 6/7/8/9.0/9.1/9.2/ 9.3/10.0, Enterprise Server 8/9
TurboLinux 6/7/8/10 - Linux on Cavium Octeon
- FreeBSD
3.0/3.4/4.0/4.5/4.8/5.1/5.2/5.3/ 5.4/6/6.1 on Intel, 6.0 on AMD64 - OpenBSD
3.6/3.7/3.8 on Intel and on AMD64 - HP-UX
10.20/11.0/11.11/11.23 on HP-PA, 11.23 on Itanium 2 - AIX
4.2/5.1/5.2/5.3 on PowerPC - Solaris
Solaris 7/8/9/10 on Intel
Solaris 8/9/10 on SPARC
Sun OS 5.6 on SPARC - SCO
UnixWare 7.0 to 7.1.4 on Intel
OpenServer 5.0.5/5.0.7/6 on Intel - OpenVMS
5.4-3 on VAX
1.5 to 7.x on Alpha
8.2 on Itanium 2 - NetWare
4.2/5.0/5.1/6.0/6.5, Open Enterprise Server
Disk space: 10–12 MB
Memory: 25–30 MB RAM
