Re: AV - Full scans or On Access Scans

["Consolvo, Corbett D" <cc72 () TXSTATE EDU>]

In my experience, as much as I hate full scans (and the challenges they bring), they have caught things that the 
on-access scanner has not.
Thanks,
Corbett Consolvo
Texas State University

From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Jenkins, 
Matthew
Sent: Thursday, April 10, 2008 8:13 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] AV - Full scans or On Access Scans

In theory, the on-access scanner would nab the malware if the malware tried to execute after signatures to detect it 
were installed.

Hence, a full system scan shouldn't be necessary, because the on-access scanner should detect all 
malware/virus/Trojan/malicious code before it executes.  Most on-access scanners scan things as they are read/wrote 
from/to the file system, so even if someone tried to copy a virus it should be caught.  We see this a lot on our FTP 
server where students will upload infected Word documents and the on-access scanner will immediately quarantine the 
file.

If the AV engine is shutdown or the signatures are out of date due to a Trojan-type piece of code, the enterprise 
console or a NAC should catch this and report back.  This would catch any attacks where either the code was executed 
during a time when no signatures were available to catch it or the on-access scanner was disabled for administrative 
purposes (i.e. software installation).  If the on-access scanner was not compromised and the signatures were updated 
after the malicious piece of code was installed, the AV software should catch the malware in memory with a 'quick scan'.

However, because that's all theory, I don't trust on-access scans enough to not do (or want to do) a full system scan 
of all hosts.  I am curious if anyone else has thoughts on that.  Does a full system scan really buy us anything, other 
than sleep at night (a highly valued commodity)?  Just a thought.

Matt

Matthew Jenkins
Network/Server Administrator
Fairmont State University
Visit us online at www.fairmontstate.edu<http://www.fairmontstate.edu/>

From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Charlie 
Prothero
Sent: Wednesday, April 09, 2008 9:13 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] AV - Full scans or On Access Scans

We had the same problem at Keystone College.  Theoretical question here: Say a piece of malware gets onto a machine 
before your AV software has a signature for it.    The AV software is subsequently updated to detect that malware.  If 
the malware had managed to install itself, it's gone on the next reboot.  Otherwise, it's just sitting on the drive, 
undetected because it isn't referenced.  If it was, the AV software would nab it.  Obviously, it's not *desirable* to 
be storing a virus collection, but how much of a problem would it be, provided the AV on-access scanner is active?