Real-time AV scanner question

Discussion in 'other anti-virus software' started by NAMOR, Nov 28, 2011.

Thread Status:
Not open for further replies.
  1. NAMOR

    NAMOR Registered Member

    Joined:
    May 19, 2004
    Posts:
    1,526
    Location:
    Arkham Asylum
    Which AV currently have caching or fingerprinting of files on the real-time scanner? Do they all re-cache when an update is applied or are there some that do not refresh the cache after an update?
     
  2. atomomega

    atomomega Registered Member

    Joined:
    Jul 27, 2010
    Posts:
    1,285
    As far as I know, most of the AV's that do implement fingerprinting/caching allow you to change what to do with the cache.
    Avast! for example, gives you the option to keep persistent cache (multi-session) or to rebuild the cache on a per-session basis (single session).
    Panda Cloud gives you the option to do a background scan everytime it synchronizes with the cloud.
     
  3. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    It's a bit more complex than that and it works on 2 levels.

    First level is transient or session cache. This cache will hold the data of the currently scanned files that will not be rescaned.

    Second level is persistent cache. This cache is a whitelist. Files that are in this cache will never be scanned and as such gives a nice performance boost as well as help to avoid false positives.

    It is important to mention third thing though. If avast! at any point performs a signature update or any of the files mentioned get modified (either in transient or permanent cache), they are rescanned to ensure security.

    All programs cache data in a very similar way because only this way you provide higher operformance without any loss in security.
     
Loading...
Thread Status:
Not open for further replies.