0

I need to run multiple Antiviruses in my system. Inevitably I cannot. So, I thought docker is a good option. But I think it is not possible. Because Antiviruses are kernel-mode and the kernel is shared between multiple dockers. Correct?

If so, what is your idea about another method? Use of Virtual Machines is not a good option. For example I need 10 virtual machines if I use 10 Antivruses.

Edited:

Another question: Is it possible to install multiple AV in one system and disable real-time scan in order to avoid any conflicts?

  • Why do you want to run so many? For what purpose? – schroeder Nov 24 '17 at 18:10
  • I don not use Virustotal, etc. – Mohammad Reza Ramezani Nov 24 '17 at 18:22
  • What do you plan to gain from doing this? Are you comparing AV vendors? Are you concerned that one AV will pick up something that others do not? Do you have security concerns for the system in question? AV also is pretty hoggish of system resources - I fear that trying to run 2 concurrently, let alone 10, will slow system performance pretty badly. – baldPrussian Nov 24 '17 at 19:21
  • 1
    If you don't want to use Virustotal, I may suggest you nodistribute.com . According to their website, they never distribute the results. – JackSparrow Nov 25 '17 at 8:09
1

Disclosure: I work for AV vendor.

The answer depends on whether you are talking about:

  • Anti-malware engine which scans content without executing it. This is what people call "scanning a file", and what is used, for example, by VirusTotal;
  • Anti-malware engine which detects malware by monitoring running processes for malicious activity (this is often called "behavior analysis").

For the first one, with exception of Symantec, which reportedly runs parts of antivurus engine in kernel, I don't know of any other vendor whose anti-malware engine runs in kernel. Even for Symantec it was matter of choice and not the requirement, as the anti-malware engine has the same detection when running in userspace. Kernel module is required to intercept events (such as file access), but the accessed file name is typically passed to userspace and scanned there; there are no requirements to scan it in kernel.

For the second one, while this engine is usually also implemented mostly in userspace, it depends a lot on its sensors implemented via kernel drivers. Without them the engine will not detect anything.

Thus the final answer is:

  • Yes, it is possible to install multiple anti-malware products on the same system. Because this scenario is not supported by most security products, who would ask you to uninstall another product, this would require tweaks, such as deleting product installation information so the products would install together.

  • The detection rate in this scenario would only be limited to one of static/dynamic anti-malware engine, and runtime detection would not apply (it would have to be disabled).

  • As this configuration is unsupported and achievable only via tweaks, it is inherently unstable, and can collapse (crash/deadlock) easily. Especially once one of the security products receives a product update;

  • Running them in different virtual machines is a much better solution, as the resources used by the anti-malware product running scans would be quite significant;

  • Why not use VirusTotal instead?

|improve this answer|||||
0

It isn't a good idea to try to run multiple active AV tools by any method. However, there are plenty of non-active tools that you could easily run on a rolling schedule.

If you try to run multiple active tools - while you could install each in a VM with a shared drive - you would likely hit file locking issues, you would certainly take a heavy performance hit on the drives.

I would choose a decent active tool and then periodically (during quiet periods) - run batch checkers.

You should note that none of this is likely to increase your security in regard to zero-day issues.

|improve this answer|||||
  • Sure, sorry I wasn't very clear - all I mean by that is one of the standard anti-virus tools that is always active and that scans files as they change. As opposed to a batch checker that you have to run manually or on a schedule. Many AV tools do both. The problem with the dynamic checks is that they have to go to extremes to protect themselves from attack - they burrow as far down the OS levels as they can in order to do this. This often causes stability issues in the OS. – Julian Knight Nov 24 '17 at 20:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.