Do you disable on-access scanners when scanning on-demand?

[mattfrog]

I've always been under the impression having files scanned by multiple products at once can create "loops" where each AV is chasing after the other as it accesses the file.

Is this true? And either way, do you disable on-access scanners when scanning on-demand?

[tomazyk]

I don't use on access scanning and use on demand only. I run only one at the time.

[xxJackxx]

No, I don't but I do set up exclusions in all scanners for any other scanners installed.

[Hungry Man]

Originally Posted by mattfrog

I've always been under the impression having files scanned by multiple products at once can create "loops" where each AV is chasing after the other as it accesses the file.

Is this true? And either way, do you disable on-access scanners when scanning on-demand?

This only happens when you use a realtime AV and it's scanning at teh same time that you're scanning the file with an on demand OR with two realitime AVs.


If you have a realtime AV installed but it isn't scanning you can use an on demand without issue.

[HKEY1952]

Originally Posted by Hungry Man

This only happens when you use a realtime AV and it's scanning at teh same time that you're scanning the file with an on demand OR with two realitime AVs.


If you have a realtime AV installed but it isn't scanning you can use an on demand without issue.

If the Antivirus' real-time protection is configured to 'scan files on access' or 'scan files on execution' then
when the On Demand Scanner of the other security software accesses or unpacks an archive for scanning, then the
files, archived files, and the unpacked archives will be scanned by the real-time protection of the Antivirus and
the other security software in that proximity of 'time'.


Voted = NO, I don't


HKEY1952

[blacknight]

Originally Posted by xxJackxx

No, I don't but I do set up exclusions in all scanners for any other scanners installed.

I do the same.

[HKEY1952]

Originally Posted by xxJackxx

No, I don't but I do set up exclusions in all scanners for any other scanners installed.

So what you are configuring is for scanner 'A' not to scan scanner 'B' and for scanner 'B' not to scan scanner 'A'.
However, that does not prevent both scanners from scanning the same file in same proximity of 'time' if one of the
scanners real-time protection is configured to 'scan files on access' or 'scan files on execution'.

The two and only ways to prevent both scanner 'A' and scanner 'B' from scanning the same file in the same proximity
of 'time' is to:

one = configure one of the scanners to exclude file 'X'
two = configure both scanners as On Demand Scanners with no real-time protection


EDIT: clarity


HKEY1952

[Hungry Man]

Originally Posted by HKEY1952

If the Antivirus' real-time protection is configured to 'scan files on access' or 'scan files on execution' then
when the On Demand Scanner of the other security software accesses or unpacks an archive for scanning, then the
files, archived files, and the unpacked archives will be scanned by the real-time protection of the Antivirus and
the other security software in that proximity of 'time'.


Voted = NO, I don't


HKEY1952

I doubt that's how it works but I don't know.

[moontan]

only on demand AV scanners here as well.

i don't need this stuff hogging precious system resources.

[xxJackxx]

Originally Posted by HKEY1952

So what you are configuring is for scanner 'A' not to scan scanner 'B' and for scanner 'B' not to scan scanner 'A'...

Not quite what I am doing. Scanner 'A' runs on-access and has exclusions for scanners 'B', 'C', and 'D'. Scanner 'B' runs on-demand and has exclusions for scanners 'A', 'C', and 'D', and so on. So if I run a scan with scanner 'B', 'C', or 'D', I do not disable scanner 'A' to do so.

[HKEY1952]

Originally Posted by Hungry Man

I doubt that's how it works but I don't know.

Well now you do know.


HKEY1952

[HKEY1952]

Originally Posted by xxJackxx

Not quite what I am doing. Scanner 'A' runs on-access and has exclusions for scanners 'B', 'C', and 'D'. Scanner 'B' runs on-demand and has exclusions for scanners 'A', 'C', and 'D', and so on. So if I run a scan with scanner 'B', 'C', or 'D', I do not disable scanner 'A' to do so.

Excluding the scanners from scanning eachother does not prevent each individual scanner from scanning files.
Files desired to be excluded from scans must be added to each individual scanners Exclusion List.

Example: C:\Program Files\Xapplication\xapp.zip

xapp.zip would be excluded from scans by all the scanners if xapp.zip is included in each scanners Exclusion List.

The only scanner that should not have exclusions is the real-time scanner.


HKEY1952

[Hungry Man]

Originally Posted by HKEY1952

Well now you do know.


HKEY1952

Somehow your word is not quite good enough. Do you have anything showing that an on-access realtime AV would scan a program that's being read by another scanner? I'd be very surprised if this were the behavior, as reads could be performed by the OS for caching or indexing. I suppose heuristics could potentially set this off but I also doubt that as well.

If you have actual information, share it.

[HKEY1952]

Originally Posted by Hungry Man

Somehow your word is not quite good enough. Do you have anything showing that an on-access realtime AV would scan a program that's being read by another scanner? I'd be very surprised if this were the behavior, as reads could be performed by the OS for caching or indexing. I suppose heuristics could potentially set this off but I also doubt that as well.

If you have actual information, share it.

On access scanners depend upon file system application programming interfaces (APIs) to monitor file access.

Who Goes There? An Introduction to On-Access Virus Scanning, Part One by Bill Hayes
At the basic level, the on-access scanner examines files each time a file open (OpenFile API for the Windows world)
or file close (CloseFile API for the Windows world) programming call is made by a program. During the file open
operation, the on-access virus scanner examines the file contents, searching for signs of virus infection.

Source
http://www.symantec.com/connect/arti...nning-part-one


HKEY1952

[Hungry Man]

Ok... but does an on demand scanner "open" the file or simply read it?

You need to have
1) The on-demand scanner actually open the file
2) The on-access realtime scanner

So if an on-demand scanner actually sets off whatever the OpenFile API looks for than it'll potentially interfere with on-access realtime scanners.

If they're using emulation heuristics... they'll open it but in a separate area. I can see a potential conflict there.

[HKEY1952]

Originally Posted by Hungry Man

Ok... but does an on demand scanner "open" the file or simply read it?

You need to have
1) The on-demand scanner actually open the file
2) The on-access realtime scanner

So if an on-demand scanner actually sets off whatever the OpenFile API looks for than it'll potentially interfere with on-access realtime scanners.

If they're using emulation heuristics... they'll open it but in a separate area. I can see a potential conflict there.

The On Demand scanner opens the file(s) Hungry Man, the only difference is the On Demand scanner is not automated,
or better choice of words, not active until executed, however, the same 'OpenFile API' programming call is made by
the On Demand scanner. This action will not interfere with the On Access scanner, just slow it down, well, both
scans will be slowed down. So in an way it is interference, however, it is minuscule, and as Voted, I do not disable
On Access scanning when running an On Demand scan. If anything I list the files I do not want scanned by the
On Demand scanners to their Excluson List to speed up the scans. Again, the On Access scanner exists no Exclusions.


EDIT: spelling


HKEY1952

[LoneWolf]

Do you disable on-access scanners when scanning on-demand?

Don't have to, no on-access scanners running at all, only an occasional scan when I feel the urge or when I'm about to put sometime on my "real" system.

[Noob]

It's been a long long time since the last time i installed 2 on-access scanners. (I did when i first joined Wilders)

[Amit]

nope....I don't disable......

[Noob]

BTW, i voted NO because i didn't do it in the past.
Currently my answer would not apply since i no longer stack AV's.