Sophos AntiVirus for Mac detection in ~/Library/Containers/2BUA8C4S2C.com.agilebits.onepassword-osx-

eak9000a

I recently installed Sophos AntiVirus for Mac and did a scan. It detected a number of items in
~/Library/Containers/2BUA8C4S2C.com.agilebits.onepassword-osx-helper/
I wonder if these are potentially real items, or is it just finding patterns in encrypted data?

Jasper

Hi @eak9000a,

What specific items is Sophos detecting?

eak9000a

Hi @JasperP,

It is hard to see the details, because the Sophos Quarantine Manger window can't be resized. Here is a capture of what I can see. However, I think the pathname shown might be bogus. If I Reveal in Finder, I get a different location.

sjk

Thanks for the followup, @eak9000a.

Those items shown in your image that Sophos has detected aren't part of 1Password. Sophos should have a log where you can see the full Path and Filename, which I'm near certain will be a location outside of the 1Password helper "Container" folder.

@Randomizer reported a similar issue in March. There's a detailed explanation of what that turned out to be in post #11 here:

Sophos finding threat seemingly having to do with 1Password. [confirmed this is a Sophos issue]

It's essentially the same symlink behavior described in this Sophos Knowledgebase article:

Sophos Anti-Virus for UNIX: use of symlinks can cause multiple virus alerts to be generated for the same file

I hope that helps. :)