Home Downloads How to install Sophos Antivirus for Linux in Ubuntu

How to install Sophos Antivirus for Linux in Ubuntu

by Kiran Kumar
Published: Updated:
Sophos for Linux

PC security is a top-notch priority these days due to ever-increasing malware threats across all operating systems, including Microsoft Windows, Mac OS, Android, and Linux.

Windows is the highest affected in this list, while Linux the least. However, every Linux user should also install Antivirus software because of cross-platform data transfer between the operating systems. Though viruses made for Windows can’t infect a Linux PC, you don’t want your beloved PC to be a medium for transferring infected files.

Installing Free Sophos Antivirus for Linux in Ubuntu/Linux Mint/elementary OS

When it comes to PC security, Sophos is a highly respected and famous brand. They have made a free version for Linux that comes with a virus scanner and a removal tool. What more, it also includes a real-time scanner that can detect threats on the fly. Let’s check out how to install it on your P. This guide is tested on Ubuntu 17.10 but should also work on older versions.

Step 1) Go to the Sophos website and download the latest copy of the Sophos Antivirus for Windows. You may have to accept their terms and provide an email ID during free registration.

Download Sophos Antivirus for Linux

Step 2) The downloaded package is a compressed archive file. It should look like sav-linux-free-9.tgz. The version number may be different based on when you download it. I’m assuming that the downloads are going here. If it’s different in your case, navigate to it in the terminal using the ‘ls’ and ‘cd’ command.

Launch ‘Terminal’ and propagate to the ‘Downloads’ directory.

Installing Sophos in Ubuntu Terminal

Installing Sophos in Ubuntu Terminal

Use the ls command to list all directories to know where to navigate.


Step 3) Use the cd command to go inside the ‘Downloads’ directory.

cd Downloads

Step 4) Again, ls command to see the contents of the ‘Downloads’ directory.


Step 5) Use the tar command to extract the contents of the .tgz file. Replace the filename after -xvzf with your downloaded file name.

tar -xvzf sav-linux-free-9.tgz

Step 6) You should see the list of extracted content in the Terminal. Use the ls command to see inside the extracted content.


Step 7) Use the cd command to propagate into the sub-directory.

cd sophos-av

Step 8) Use the following command to run the sh installer.

sudo sh ./install.sh

Step 9) Press <enter> and <space> to scroll to the bottom of the super long agreement and enter ‘Y’ to confirm the installation.

Step 10) You will see a prompt whether to install Sophos in /opt/sophos-av directory. That is typical of the Linux directory structure. Go ahead and press <enter>.

Where do you want to install Sophos Anti-Virus? [/opt/sophos-av]

Step 11) Next, it will ask if you want to enable on-access scanning. It is a great feature that will detect malware on the fly when transferring files. It will consume some RAM in the background, but it’s worth it.

Do you want to enable on-access scanning? Yes(Y)/No(N) [Y]

Enter ‘Y’ and press <enter>

Step 12) Choose what type of updating you want. I chose ‘s’.

Which type of auto-updating do you want? From Sophos(s)/From own server(o)/None(n) [s]

Step 13) Key in ‘f’ to select free Sophos Antivirus, which will have no support.

Do you wish to install the Free (f) or Supported (s) version of SAV for Linux? [s]

Step 14) Enter proxy info if needed. I have none, so I entered ‘Y.’

Do you need a proxy to access Sophos updates? Yes(Y)/No(N) [N]

Step 15) Installation complete!

Installation Complete

Installation Complete

Fetching free update credentials.
Installing Sophos Anti-Virus....
Selecting appropriate kernel support...
When Sophos Anti-Virus starts, it updates itself to try to find a Sophos kernel interface module update. This might cause a significant delay.
Sophos Anti-Virus starts after installation.

Installation completed.
Your computer is now protected by Sophos Anti-Virus.

Using Sophos Antivirus for Linux

Sophos Antivirus for Linux is a complete command-line tool. There is no GUI for it. Therefore, you need to know the following commands to start using it.

How to check if on-access scanning is active?

Enter the following command in the ‘Terminal.’


How to start on-access scanning?

Use the following command to enable and start the on-access scanning if found that the service is inactive.

/opt/sophos-av/bin/savdctl enable
/etc/init.d/sav-protect start

How to run an on-demand scan?

Just enter the following command to start scanning your computer.

savscan /

If it finds malware, you will see a pop-up similar to this one:

Sophos Antivirus Virus Alert

Sophos Antivirus Virus Alert


That concludes the guide to the installation of the Sophos Antivirus on the Linux system. With a built-in real-time scanner and daily updates to the virus database, Sophos is one of the best antivirus software not only for Linux but across other cross platforms too.

I hope you find this guide useful in setting up Sophos and using it.

You may also like


Sadid Hasan Rakib May 30, 2018 - 1:33 PM

Can you please help me? i have installed Sophos antivirus for Ubuntu 16.04. It has installed without any problem, but on-access scanning is not activated. I have tried to activate it through this command “/opt/sophos-av/bin/savdctl enable”. But it shows me Failed to activate on-access scanning. Will you please help me out from this problem.

Ivanus June 15, 2018 - 2:50 PM

sudo /opt/sophos-av/bin/savdctl enable

Bob January 21, 2019 - 2:16 PM

Very useful. Thank you.

Oygar February 21, 2019 - 1:36 PM

Hello! Thank you very much for the perfect explanation!
It was very easy to install sopho after reading your post. But, have you any idea why i have this messages in the terminal when i try to enable and start on-access scanning?

I’m running Linux Mint 19.1 Tessa

Thank you again!

/opt/sophos-av/bin/savdctl enable
Failed to enable on-access scanning.

/etc/init.d/sav-protect start
bash: /etc/init.d/sav-protect: No such file or directory

Castigo HD May 19, 2019 - 9:50 AM

Thank you. successfully installed on Ubuntu 18.10

aAli August 12, 2019 - 4:29 AM

i run sudo savscan -h, it gave me message i need to have superuser rights in order to scan boot sectors.


J Anzani October 8, 2019 - 10:34 AM

Thank you very much. It took a little searching but once I found this page it was really quick to follow your clear instructions.
Very helpful Indeed.

Andreas December 13, 2019 - 7:04 PM

Thank you very much.
You helped me a lot, to install an run Sophos.

Best Regards,

Ben June 9, 2020 - 9:16 AM

Something critical – how to update to latest virus definitions:

$ sudo /opt/sophos-av/bin/savupdate
Successfully updated Sophos Anti-Virus from sdds:SOPHOS

Jorge Lopez June 17, 2020 - 8:23 PM

Thank you!
It was very useful indeed!

Cody August 16, 2020 - 10:40 PM

Can this be ran alongside Clamav? I am running Ubuntu Virtual box.

Mariana September 4, 2020 - 4:45 PM

Hi, has anyone been able to install Sophos in Linux lately? I’m trying to donwload it for my Ubuntu laptop but I cannot find the option in the website. For the free, single device version it only comes for Windows and Mac.

Stuart October 3, 2020 - 5:09 AM

I’m looking for info on this as well. I have the source file I downloaded in 2016 that I need to reinstall on a new Linux installation, the installer script is exiting with this error:

Fetching free update credentials.
Installation aborted.
Failed to get free credentials

dandan657 October 21, 2020 - 7:52 PM

Hello, sadly they want to end with free users and focus on the bussiness sector. Similar to other antivirus for Linux. For that reason they retired the download links.
Presumably they’re going to keep the support for the current free users until 2023. So, if you can get one “sav-linux-free-9.tgz”, you can still have support. (In one post, of the comment section, a user posted theirs)
Instead, the only avaibable antivirus for Linux desktop, that I know, is Eset (35€)

dandan657 October 21, 2020 - 7:57 PM

When I said “the only available antivirus”, I want to say antivirus with real time protection. Everybody knows ClamAv

harry April 1, 2021 - 12:16 AM

is sophos opening port like clamav?
are php application can use it to scan file upload via port?


Leave a Reply to J Anzani Cancel Reply



FOSS Linux is a leading resource for Linux enthusiasts and professionals alike. With a focus on providing the best Linux tutorials, open-source apps, news, and reviews written by team of expert authors. FOSS Linux is the go-to source for all things Linux.

Whether you’re a beginner or an experienced user, FOSS Linux has something for everyone.

Follow Us


©2016-2023 FOSS LINUX



“Linux” is the registered trademark by Linus Torvalds in the U.S. and other countries.