Real-time AV scanner question

Which AV currently have caching or fingerprinting of files on the real-time scanner? Do they all re-cache when an update is applied or are there some that do not refresh the cache after an update?

 

As far as I know, most of the AV's that do implement fingerprinting/caching allow you to change what to do with the cache.
Avast! for example, gives you the option to keep persistent cache (multi-session) or to rebuild the cache on a per-session basis (single session).
Panda Cloud gives you the option to do a background scan everytime it synchronizes with the cloud.

 

It's a bit more complex than that and it works on 2 levels.

First level is transient or session cache. This cache will hold the data of the currently scanned files that will not be rescaned.

Second level is persistent cache. This cache is a whitelist. Files that are in this cache will never be scanned and as such gives a nice performance boost as well as help to avoid false positives.

It is important to mention third thing though. If avast! at any point performs a signature update or any of the files mentioned get modified (either in transient or permanent cache), they are rescanned to ensure security.

All programs cache data in a very similar way because only this way you provide higher operformance without any loss in security.