1

Antivirus scans consumes resources, and far more when the full disk or RAM is scanned. Anyway, files are scanned before opening and often when they enter the system, so periodic scans on this point of view may be runned not frequently, possibly not at all.

Can antivirus be configured to scan a file when it is modified? If yes, what justify periodic scans of disks and RAM? Then what are the recommanded periodicities for both?

  • 1
    It is not a secret that many AV keep track of file changes, to skip gazillions of system files that are not change or known by the AV. Most top AV has a scheduler scan features that target particular folder, which often not used by user. – mootmoot Sep 27 '18 at 12:47
1

This is going to be entirely dependant on the anti-virus tool you're using and the environment it's deployed.

Here are some characteristics to consider;

  • Time between signature updates
  • Impact on system usability during a scan
  • Capability of your AV tool
  • Endpoints running your AV tool

For mainstream corporate AV solutions, it's typical to see signature updates every 24 hours. This may mean you want to run a scan of some kind on your systems as soon as they've been updated to detect new malware: how up-to-date is your detection engine?

If you have any legacy systems or are running intensive applications, you may want to wait until the weekend to run a full system scan: what is the impact of running a full scan on a system?

The capability of an AV solution will vary. Some may only offer cursory protection when a file is ran, others may offer granular detail whereby policies can be implemented to scan newly created files or recently modified files: what is your AV capable of doing?

Not all endpoints require scanning at the same frequency. Some devices may be rarely used or are covered by other protections, thus reducing their potential for infection, others may be deemed high-risk and will want to be scanned every day: What are your low/high risk assets?

There is no real right or wrong answer here but as a security-minded individual you'll lean towards as frequent as possible but ensure you are aware of the functional impacts: consult your users, admins and assess your environment. In an ideal situation you would be running scans constantly but in reality, it's just not possible.

1

I am not aware of antivirus programs scanning files when they are changed, but they don't really have to. As long as they are scanned before they are loaded/executed and the program modifying them is scanned, it should be fine.

There are many reasons to scan RAM for viruses. I can think of two major ways viruses may appear in RAM even though the files were scanned. One is for the virus to be encrypted. The antivirus would not be able to identify it, unit it was decrypted in memory. The other is by network attack, for example abusing a buffer overflow to write the virus directly to memory without storing it in a file. However, many antivirus programs will have ways to deal with both of these scenarios to some degree. Obviously this means ideally you would want to scan your memory as often as possible and you need to balance it with your performance requirements.

The reason why full disk scan is justified is that antivirus signature databases are being updated regularly (possibly every day). A virus may not have been known and detectable when the file was downloaded but may be detectable now. However, because files are scanned on load, this only makes sure there are no latent viruses on the disk. I would say once a week should be enough for this.

  • I keep disagreeing with you today, Peter. Third way: malware infects before it is known to the AV scanner and persists in memory after a signature update would find it. – symcbean Sep 27 '18 at 14:29
  • @symcbean I said at least, and basically described it with the HDD one. But ofcourse yes, it may persist in memory as well. And there are probably more, I just wanted to ilustrate som ways it is usefull. I am not even close to being competent enough to try to list all of them. I probably should have made that clearer. – Peter Harmann Sep 27 '18 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.