Scan engines and virus defs

  • Thread starter Thread starter Gururajan Ramachandran
  • Start date Start date
G

Gururajan Ramachandran

[Please reply in newsgroup as email box is very small]

Hello,

What is the relationship between scan engines and virus def. files?

Is it possible to update virus defs. but not scan engine and be fully protected?
If not, what would the scan engine update do that virus defs. update does not
do?

Would you know a short list of the best anti-virus software for Linux email
servers?

Thank you.

Guru
 
Gururajan said:
[Please reply in newsgroup as email box is very small]
Hello,

What is the relationship between scan engines and virus def. files?
Click to expand...

scan engines use def files in order to know what to look for when
scanning for viruses...
Is it possible to update virus defs. but not scan engine and be fully protected?
no...

If not, what would the scan engine update do that virus defs. update does not
do?
Click to expand...

it updates the *way* the engine looks for viruses rather than just what
the engine looks for...
 
[Please reply in newsgroup as email box is very small]

Hello,

What is the relationship between scan engines and virus def. files?

Is it possible to update virus defs. but not scan engine and be fully protected?
If not, what would the scan engine update do that virus defs. update does not
do?
Click to expand...

That question cannot be answered without knowing specifics. Sometimes
older scan engines are ok to use for quite awhile. Sometimes older
scan engines only _seem_ ok to use, but some forms of malware are no
longer handled in spite of current defs. In general, you had best ask
your av vendor for advice and information if it isn't available at his
web site. When in doubt, use the latest scan engine version.


Art
http://www.epix.net/~artnpeg
 
Gururajan Ramachandran said:
[Please reply in newsgroup as email box is very small]

Hello,

What is the relationship between scan engines and virus def. files?
Click to expand...

The engine uses the def files as data.
Is it possible to update virus defs. but not scan engine and be fully protected?
Click to expand...

Possible, yes. However, there could be a need to use a newer
engine to make full use of a newer def file.
If not, what would the scan engine update do that virus defs. update does not
do?
Click to expand...

Hypothetically, consider an engine that executes the first fifty instructions
of an encrypted virus file in an emulated environment in order to reveal
the code necessary to match against the def file's data. If a virus is written
that requires that emulated execution proceed for fifty-four instructions
before enough code is revealed, you would need a new engine to take
full advantage of the new def.
Would you know a short list of the best anti-virus software for Linux email
servers?
Click to expand...

Many vendors are starting to make Linux versions, but I haven't
heard any feedback about any of them.
 
(e-mail address removed) (Gururajan Ramachandran) wrote in
[Please reply in newsgroup as email box is very small]

Hello,

What is the relationship between scan engines and virus def. files?
Click to expand...

The scan engine compares what it finds in the virus def files and other
files. A match indicates an infection.
Is it possible to update virus defs. but not scan engine and be fully
protected? If not, what would the scan engine update do that virus
defs. update does not do?
Click to expand...

Virus def. files are updated very often, sometimes more than once per day.
Scan engines are updated much less often, usually when some technology
requires it, such as adding the ability to scan for a new type of problem,
or to add some new feature. More than likely, if you don't keep your scan
engine updated, you will not be as fully protected as just updating the
virus def. And sometimes, a new virus def. forces you to update your scan
engine.
Would you know a short list of the best anti-virus software for Linux
email servers?
Click to expand...

Can't help on this.
 
Back
Top