4

If AV auto-scan will detect and prevent the malware from executing why there is a need to enable schedule/full scans?

I'm asking because a full scan can create sometimes overhead on the machine and network, so I'm trying to understand the advantages of enabling full scanning if auto-scan will provide AV protection when a file is used.

Terminology:

Auto-Protect-- Auto-Protect is the first line of defense against threats by providing real-time protection for your computer. Whenever you access, copy, save, move, open or close a file, Auto-Protect scans the file to ensure that a threat has not attached itself. By default, it loads when you start your computer to guard against threats and security risks. It also monitors your computer for any activity that might indicate the presence of a threat or security risk. Auto-Protect can determine a file's type even when a threat changes the file's extension.

Full Scan--WIll scan each file by starting with A to Z its not real-time.

5 Answers 5

4
+25

Lots of right answers but none of them seems both clear and complete to me.

You need scheduled full anti-malware scans for the following reasons:

  • Seemingly innocuous executable files may hide payloads in seemingly innocuous file types
  • At the time of the infections the anti-virus definitions might not have included the necessary signatures. Real-time protection might reveal live infections, but not dormant infections or first-stage payloads (e.g. documents with macros).
  • Some malware hides in seemingly innocuous file types leveraging application vulnerabilities such as buffer overflows. This can be for example the case of with large video files.
  • The antivirus might only be able to detect the consequences of an infection, such as encrypted files or ransom requests
  • Malware not executed is still dangerous, for example if it is transferred to other machines without onboard anti-malware.

Full scans should not create overhead, as they should run locally and either be scheduled during idle time or run on low CPU resources.

3

It is extremely common for Anti Virus software to continuously update their scanning rules/parameters to allow the software to cast a wider net and detect the latest varieties of malware.

Usually, this update works hand-in-hand with the scheduled-full scan. Before a full scan happens, the software will check for updates then proceed to do the scan.

'Auto-Protect' basically just detects for malware with the current un-updated checklist. Hence with the full-scan + updates, it allows them to be sure that the latest malware is being hunted!

2

From your description of a full scan a reason why it is better, is if a file or executable on your computer that is malicious was downloaded from the internet, but bypassed the Auto-protect at the time. This is possible if the type of virus was was not known at the time the file was downloaded, (this type of scenario is called a "Zero Day" scenario).

Here your description of full scan will work if a future security definition or patch update to the antivirus program, gives the ability to the antivirus program to be able to detect the new virus. Of course the Auto-protect may be able to detect the virus now, but only if the virus is running. If the virus is not running, and is in a dormant state, the only way the Antivirus program will detect the virus is by searching thru every file on the computer.

Full Scans usually occur by default when the Antivirus Software is updated, not a patch update. Since AV software updates are usually to fix issues where the antivirus programs have flaws where even with a virus definition, a virus if created properly could leverage those flaws. In this situation not even a Full Scan would work, but if the Antivirus Software can be updated before such a scenario or even during (less likely), then the virus can get caught. The latter is more of the reason why, as a safe guard that AV programs usually run a full scan after updating the AV software. It also relates to the reason why, other than registry and system monitoring access issues, that AV software after a software update asks to restart a computer. That is why usually after a AV software update, the startup time after the restart is seen to be a bit longer than usually, as the AV is now doing a full system scan. Many AV software do this by default. This only happens during the startup/reboot process after a AV software update.

2
  • If the virus is not running (dormant state) then it's not posing a risk? it will be detected by auto-scan once it will be operational (opened), right?
    – Filipon
    May 24, 2020 at 3:10
  • Answer to first question, not logically as a virus is not a worm (which is like a virus except it executes without user interaction). However, the risk that someone accidentally opens the virus containing file is still existent. Answer to second question. Autoscan will only detect it if there is a patch for that virus which the antivrus program already installed. If the virus is still a zero day virus, then there is no difference as the zero day virus was not detected the first time by the anitvirus program. May 24, 2020 at 3:16
1

Typically (and perhaps just personally) I don't perform full scans on schedule or any other method unless I notice actual symptoms or suspicious system activity/behavior. On the other hand, some may disagree with this - I would have been among them 10-15 years ago - therefore, if its believed to be a necessity, I suggest a monthly full/schedule scan.

However, as I've already mentioned, a quick scan (under reasonable circumstances and/or in most cases) is sufficient assuming the rest of the network or system security features are in place and enabled (i.e. router, firewall, up-to-date software, etc.). As you pointed out, and obviously know from experience, a full system scan is debilitating to even some higher-end systems.

I was honestly surprised to see how much my system was bogged down - my first actual higher-end system in two decades - for some reason I had it in my head that solid-state drives would help tremendously with that (and I'm sure it does) but it still grinds my other activities close to a halt.

1
  • What does sufficient mean in your case? will it detect in the same level as full scan is configured?
    – Filipon
    May 23, 2020 at 7:02
1

Your definitions explain why:

...Whenever you access, copy, save, move, open or close a file...

And what of processes that create files on their own? I could write a Powershell script that will not get picked up by AV, because it is not malicious, but it can write a malicious file. If I can get a non-user process to trigger this, then you have malware just sitting there.

Also, AV is not perfect. You want to have a chance to find malware before it gets executed, opened, or otherwise interacted with.

As with any security control, you have to weigh the cost/benefits. If you can schedule your scan when you are not actively using the device, like when you are asleep, then you can avoid the effect of the overhead on the machine and network. This is what most everybody does when they enable full-system scanning.

1
  • In principle if the powershell script writes a malicious file it would close the file after writing it. So, at least in principle, it seems that this example would also get caught by the "auto scan." However, I think the point is that if somehow the malicious file happened to be on disk already then the full scan would find it but not the autoscan.
    – hft
    May 29, 2020 at 20:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .