How Web Scanner works ??

this isnt A vs B thread
i just wondering about how web scanner works..
does it scan data stream (before file created) or scan partial file that downloaded into temporary folder/ using internal proxy ?
i ask because i see different behaviour on some AV.
eg. ESET will terminate connection and quarantine but Kaspersky & AVAST just terminate connection.

 

You also have to consider the browser being used. Not all browsers play the same way with a web scanner.

 

Not sure about ESET, but Kaspersky scans packets coming through ports (eg, port 80 commonly for web-traffic), buffers it (stores some of it in its memory), scans a little bulk of it, and then sends it to your computer - loop process.

If malicious code is detected, terminate connection and kill buffered content.

Sometimes why users see a short delay if the settings are wrong - "limit traffic caching time" or "buffering time".

 

so kasperksky scans data stream ?

 

Yes. It scans the packets as they are transmitted through the data stream.

 

anyone can confirm how ESET web protection module work ?

 

Previously answered here: https://www.wilderssecurity.com/showpost.php?p=1363104&postcount=2

 

ooh,, thanks..
so from these 2 kind of web scanner what are the adv/disadv ?

 

As per Please see our Policy concerning these type questions.

we close just as the thread veers off into undesired A & B type of a thread. Thank you all