A question for Anti Virus gurus :P

Phal · 22 Apr 2009 at 13:25

I have a question... not sure how much sense ill be able to make so bear with me!

We have customers with servers and on those servers we have a tool which copies data to a replica server held in our office.

On the customer server we have added exceptions to excluded the backup software. The backup software takes copies of updated data and puts it into temp files in a staging area awaiting to be uploaded to our office. These staging areas with temp files are exluded from the AV software.

My question is - as the process which takes copies of files go around taking copies of updated files, will the AV have to scan each file which is checked/accessed?

If this is the case, can we add the backup process itself to an excetion to stop the AV software scanning any files it accesses?

iaind · 22 Apr 2009 at 14:00

It depends on how your AV is configured.

Most will allow the real time scanning to be set to scan on read/write or both. If you have excluded the temp area and are scanning on write, they wont be scanned during the copy process.

However, if you are scanning on read, they will be scanned as the process reads them from the source folder.

Most solutions will allow you to exclude the backup process from scanning

Phal · 22 Apr 2009 at 16:25

Whats the norm for On Access scanners? To scan on read and write? or just one?

iaind · 22 Apr 2009 at 16:31

One or t'other normally otherwise you'd incur a fair overhead

Sophos defaults to on read

Phal · 23 Apr 2009 at 09:09

I guess Read is preferred since if it reads a virus it picks it up earlier than if it just monitors writes? :\ Or would it make no difference lol

Think the customer in question has Symantec AV so Ill have a peak to see what its set to.

RSR · 23 Apr 2009 at 09:17

Phal said:
Think the customer in question has Symantec AV so Ill have a peak to see what its set to.

Shudder....

Is this Symantec End Point? :mad:

Phal · 23 Apr 2009 at 16:53

Probably v10. whatever without checking.

We stayed away from SEPS for as long as possible :/ but were trialled it in office again recently and it seems better than the abortion that came out initially so weve started giving it to customers who are entitled to it.

Most of our customers are Mcafee or Symantec so weve had to update the ones we can because of all the Malware around recently :\ SEPS and Mcafee with the Adware addon are better than nothing!