topic Re: Anti-Virus full scan best practice for file server. in Tech Talk

Anti-Virus full scan best practice for file server.

Eli — Thu, 04 Oct 2018 05:32:11 GMT

Hello folks,

I have a file server and it takes 6 days to finish AV full scan on the file server. In this case, what is the best practice to do AV scan? Weekly full scan? just real-time scan?

Please share your experience. Thanks

Regards,

Eli

Re: Anti-Virus full scan best practice for file server.

TonyVizza — Thu, 04 Oct 2018 07:34:53 GMT

Hi Eli,

Im sure you will get a variety of responses here, but my preferred course of action:

1) full file scan at initial setup of file server or installation of AV.

2) real time scan at all times

3) a smart file scan performed weekly in the early hours of the morning when usage is minimal.

Hope this helps.

Re: Anti-Virus full scan best practice for file server.

rslade — Thu, 04 Oct 2018 19:09:00 GMT

> Eli (Newcomer I) posted a new topic in Tech Talk on 10-04-2018 01:32 AM in the

> I have a file server and it takes 6 days to finish AV full
> scan on the file server. In this case, what is the best practice to do AV scan?
> Weekly full scan? just real-time scan?

You should probably do both: having an infection go undetected for almost a week
is probably not good, but real time detection usually takes shortcuts that may miss
some.

However, you post is short on details. Does the full scan degrade performance
while it's running? Are there options you can set? Have you tried another
product? Can you leave the full scan running on a dedicated machine? Etc, etc,
etc ...

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
Rock journalism is people who can't write interviewing people who
can't talk for people who can't read. - Frank Zappa
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

Re: Anti-Virus full scan best practice for file server.

Eli — Fri, 05 Oct 2018 03:12:33 GMT

Hi Tony,

Thank you for your reply.

it is very helpful.

Regards,

Eli

Re: Anti-Virus full scan best practice for file server.

Eli — Fri, 05 Oct 2018 03:24:25 GMT

Hello rslade,

Thank you for the reply and please see my answers below:

1. Performance doesn't matter.

2. SEP is running so there are many scanning options.

3. We haven't tried another product, but we assume it will be the same.

4. Yes, we can. Like I said, it takes 6 days for full scanning.

Regards,

Eli

Re: Anti-Virus full scan best practice for file server.

rslade — Fri, 05 Oct 2018 04:49:00 GMT

> Eli (Newcomer I) posted a new reply in Tech Talk on 10-04-2018 11:24 PM in the

> 1. Performance doesn't matter.

Then I'd suggest running the full scan weekly, as well as turning the real time
scanning on.

> 2. SEP is running so there are many scanning
> options.

Symantec is definitely not one of my recommended products: never has been.

> 3. We haven't tried another product, but we assume it will be the same.

Definitely a bad assumption. There are a whole lot that are better, and a number
that are faster as well. (Faster and better do not always go hand in hand:
sometimes they are opposites.)

> 4. Yes, we can. Like I said, it takes 6 days for full scanning.

Again, that means you can run both real time and full, with full as often as you can.

======================
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
"If you do buy a computer, don't turn it on." - Richards' 2nd Law
"Robert Slade's Guide to Computer Viruses" 0-387-94663-2
"Viruses Revealed" 0-07-213090-3
"Software Forensics" 0-07-142804-6
"Dictionary of Information Security" Syngress 1-59749-115-2
============= for back issues:
[Base URL] site http://victoria.tc.ca/techrev/
CISSP refs: [Base URL]mnbksccd.htm
PC Security: [Base URL]mnvrrvsc.htm
Security Dict.: [Base URL]secgloss.htm
Security Educ.: [Base URL]comseced.htm
Book reviews: [Base URL]mnbk.htm
[Base URL]review.htm
Partial/recent: http://groups.yahoo.com/group/techbooks/
http://en.wikipedia.org/wiki/Robert_Slade
http://www.infosecbc.org/links http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/

Re: Anti-Virus full scan best practice for file server.

CISOScott — Mon, 08 Oct 2018 21:02:45 GMT

Another thing to take into consideration, especially with "file servers". I would look at file types to ensure they are all business related.

I have run across several instances where our file servers were nearing capacity, roaming accounts took "forever" to load, etc. When we did a quick search of file types we found that people were using the file servers for their own repository of music files, video files and yes, even some movies. When we went in and removed all of these "extra" files it seems our performance improved.