Do you disable on-access scanners when scanning on-demand?

Discussion in 'polls' started by mattfrog, Apr 10, 2012.

?

Do you disable on-access scanning?

  1. Yes, I do

    6 vote(s)
    15.0%
  2. No, I don't

    32 vote(s)
    80.0%
  3. Other - I do a weird ninja trick and describe in the comments

    2 vote(s)
    5.0%
  1. mattfrog

    mattfrog Registered Member

    Joined:
    Apr 3, 2012
    Posts:
    78
    Location:
    United Kingdom
    I've always been under the impression having files scanned by multiple products at once can create "loops" where each AV is chasing after the other as it accesses the file.

    Is this true? And either way, do you disable on-access scanners when scanning on-demand?
     
  2. tomazyk

    tomazyk Guest

    I don't use on access scanning and use on demand only. I run only one at the time.
     
  3. xxJackxx

    xxJackxx Registered Member

    Joined:
    Oct 23, 2008
    Posts:
    3,590
    Location:
    USA
    No, I don't but I do set up exclusions in all scanners for any other scanners installed.
     
  4. Hungry Man

    Hungry Man Registered Member

    Joined:
    May 11, 2011
    Posts:
    9,133
    This only happens when you use a realtime AV and it's scanning at teh same time that you're scanning the file with an on demand OR with two realitime AVs.


    If you have a realtime AV installed but it isn't scanning you can use an on demand without issue.
     
  5. HKEY1952

    HKEY1952 Registered Member

    Joined:
    Jul 22, 2009
    Posts:
    646
    Location:
    HKEY/SECURITY/ (value not set)
    If the Antivirus' real-time protection is configured to 'scan files on access' or 'scan files on execution' then
    when the On Demand Scanner of the other security software accesses or unpacks an archive for scanning, then the
    files, archived files, and the unpacked archives will be scanned by the real-time protection of the Antivirus and
    the other security software in that proximity of 'time'.


    Voted = NO, I don't


    HKEY1952
     
  6. blacknight

    blacknight Registered Member

    Joined:
    Sep 25, 2007
    Posts:
    2,068
    Location:
    Europe
    I do the same.
     
  7. HKEY1952

    HKEY1952 Registered Member

    Joined:
    Jul 22, 2009
    Posts:
    646
    Location:
    HKEY/SECURITY/ (value not set)
    So what you are configuring is for scanner 'A' not to scan scanner 'B' and for scanner 'B' not to scan scanner 'A'.
    However, that does not prevent both scanners from scanning the same file in same proximity of 'time' if one of the
    scanners real-time protection is configured to 'scan files on access' or 'scan files on execution'.

    The two and only ways to prevent both scanner 'A' and scanner 'B' from scanning the same file in the same proximity
    of 'time' is to:

    one = configure one of the scanners to exclude file 'X'
    two = configure both scanners as On Demand Scanners with no real-time protection


    EDIT: clarity


    HKEY1952
     
    Last edited: Apr 12, 2012
  8. Hungry Man

    Hungry Man Registered Member

    Joined:
    May 11, 2011
    Posts:
    9,133
    I doubt that's how it works but I don't know.
     
  9. moontan

    moontan Registered Member

    Joined:
    Sep 11, 2010
    Posts:
    3,929
    Location:
    Qu├ębec
    only on demand AV scanners here as well.

    i don't need this stuff hogging precious system resources.
     
  10. xxJackxx

    xxJackxx Registered Member

    Joined:
    Oct 23, 2008
    Posts:
    3,590
    Location:
    USA
    Not quite what I am doing. Scanner 'A' runs on-access and has exclusions for scanners 'B', 'C', and 'D'. Scanner 'B' runs on-demand and has exclusions for scanners 'A', 'C', and 'D', and so on. So if I run a scan with scanner 'B', 'C', or 'D', I do not disable scanner 'A' to do so.
     
  11. HKEY1952

    HKEY1952 Registered Member

    Joined:
    Jul 22, 2009
    Posts:
    646
    Location:
    HKEY/SECURITY/ (value not set)
    Well now you do know.


    HKEY1952
     
  12. HKEY1952

    HKEY1952 Registered Member

    Joined:
    Jul 22, 2009
    Posts:
    646
    Location:
    HKEY/SECURITY/ (value not set)
    Excluding the scanners from scanning eachother does not prevent each individual scanner from scanning files.
    Files desired to be excluded from scans must be added to each individual scanners Exclusion List.

    Example: C:\Program Files\Xapplication\xapp.zip

    xapp.zip would be excluded from scans by all the scanners if xapp.zip is included in each scanners Exclusion List.

    The only scanner that should not have exclusions is the real-time scanner.


    HKEY1952
     
  13. Hungry Man

    Hungry Man Registered Member

    Joined:
    May 11, 2011
    Posts:
    9,133
    Somehow your word is not quite good enough. Do you have anything showing that an on-access realtime AV would scan a program that's being read by another scanner? I'd be very surprised if this were the behavior, as reads could be performed by the OS for caching or indexing. I suppose heuristics could potentially set this off but I also doubt that as well.

    If you have actual information, share it.
     
  14. HKEY1952

    HKEY1952 Registered Member

    Joined:
    Jul 22, 2009
    Posts:
    646
    Location:
    HKEY/SECURITY/ (value not set)
    On access scanners depend upon file system application programming interfaces (APIs) to monitor file access.
    Source
    http://www.symantec.com/connect/articles/who-goes-there-introduction-access-virus-scanning-part-one


    HKEY1952
     
  15. Hungry Man

    Hungry Man Registered Member

    Joined:
    May 11, 2011
    Posts:
    9,133
    Ok... but does an on demand scanner "open" the file or simply read it?

    You need to have
    1) The on-demand scanner actually open the file
    2) The on-access realtime scanner

    So if an on-demand scanner actually sets off whatever the OpenFile API looks for than it'll potentially interfere with on-access realtime scanners.

    If they're using emulation heuristics... they'll open it but in a separate area. I can see a potential conflict there.
     
  16. HKEY1952

    HKEY1952 Registered Member

    Joined:
    Jul 22, 2009
    Posts:
    646
    Location:
    HKEY/SECURITY/ (value not set)
    The On Demand scanner opens the file(s) Hungry Man, the only difference is the On Demand scanner is not automated,
    or better choice of words, not active until executed, however, the same 'OpenFile API' programming call is made by
    the On Demand scanner. This action will not interfere with the On Access scanner, just slow it down, well, both
    scans will be slowed down. So in an way it is interference, however, it is minuscule, and as Voted, I do not disable
    On Access scanning when running an On Demand scan. If anything I list the files I do not want scanned by the
    On Demand scanners to their Excluson List to speed up the scans. Again, the On Access scanner exists no Exclusions.


    EDIT: spelling


    HKEY1952
     
    Last edited: Apr 12, 2012
  17. LoneWolf

    LoneWolf Registered Member

    Joined:
    Jan 2, 2006
    Posts:
    3,367
    Don't have to, no on-access scanners running at all, only an occasional scan when I feel the urge or when I'm about to put sometime on my "real" system.
     
  18. Noob

    Noob Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    6,464
    It's been a long long time since the last time i installed 2 on-access scanners. (I did when i first joined Wilders) :D
     
  19. ams963

    ams963 Registered Member

    Joined:
    May 3, 2011
    Posts:
    5,936
    Location:
    Parallel Universe
    nope....I don't disable......
     
  20. Noob

    Noob Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    6,464
    BTW, i voted NO because i didn't do it in the past.
    Currently my answer would not apply since i no longer stack AV's. :D