3

Do you know if AVs scans non-persistent memory mapped file content in a Windows Environment ? (Or have the answers for some of the AV on the market) I would prefer, if possible, some real world testing or white paper, more than commercial speech from the AV developer.

ALso, do you know where I can find recent documentation about the in depth behaviour of MMF ? The one I have and the most complete is from 93', and since then I imagine some KB have updated some sec. holes in them.

Thanks in advance, I really can't find a lot of things ! :(

If not... will have to test myself :)

1

1 Answer 1

2

to question number 1, yes and no, there are virus scanners that utilize the OS-index for files to scan (almost all of them), and there are also scanners that can ascan your "flash" bios and RAM for infections (malwarebytes i.e.).

and then there are scanners that scan the complete disc, which takes far longer, and is not OS dependant (i forgot the name for this one, if you know it, yell it in the comments so i can add it!!).

most of those are run at boot, as in, as a boot-disc, take hirens Bootdisc for example, where i work, when we get a infected PC, and cant solve it in the OS itself, we use a bootdiscc with a virus/malware scanner that scans the whole DRIVE, and not just the INDEXED part (includes hidden volumes, but not encrypted ones, ofcourse).

and to the second question, no, i dont know where to find those docs, may the good god of google shine his eternal light on you

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .