Re: Trend Micro's Scan mail, DBSCAN and incremental scanning

[rob@xxxxxxxxx]

Are you sure that your PUPDATE is working?

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





Chris Whisonant <Chris.Whisonant@xxxxxxxxxxxxx> 
Sent by: domino400-bounces@xxxxxxxxxxxx
03/10/2004 04:28 PM
Please respond to
Lotus Domino on the iSeries / AS400 <domino400@xxxxxxxxxxxx>


To
Lotus Domino on the iSeries / AS400 <domino400@xxxxxxxxxxxx>
cc

Subject
Re: Trend Micro's Scan mail, DBSCAN and incremental scanning






That makes sense that an updated pattern would cause a rescan, but I don't 

know if that's what we see in the real world. When I did the full scan it 
took hours upon hours and caused the users to have trouble opening their 
databases.

I haven't investigated this, though...

Chris Whisonant
Comporium
Senior Mid-Range Systems Administrator
IBM eServer Certified Systems Expert - iSeries Technical Solutions V5R2
IBM Certified Associate System Administrator - Lotus Notes and Domino 6
803.326.7270 (W)
803.326.6142 (F)



rob@xxxxxxxxx 
Sent by: domino400-bounces@xxxxxxxxxxxx
03/10/2004 03:55 PM
Please respond to
Lotus Domino on the iSeries / AS400 <domino400@xxxxxxxxxxxx>


To
Domino400@xxxxxxxxxxxx
cc

Subject
Trend Micro's Scan mail, DBSCAN and incremental scanning






I just got off the phone with someone at Trend's support, and since it 
seemed that English was not her primary language I wanted to run this by 
the list to see if her statement was not what other's have observed.

The reason that I originally called was that if I use incremental scanning 


for DBSCAN would I miss viruses that a newer pattern would find.  For 
example I scan database xyz.nsf with pattern file 200 and it says it is 
clean.  However, since pattern file 200 is old it missed the gooneygoohoo 
virus.  Now, I've made no changes to xyz.nsf at all.  I perform an 
incremental scan on xyz.nsf with the latest and greatest pattern file 
(that will catch the gooneygoohoo virus), will it skip the xyz.nsf 
database since it was already scanned clean?  Her answer was no, since I 
have a newer pattern file, it will not do an incremental scan.

This begs the next question:  Since we check for pattern files 4 times a 
day, and you can pretty much guarantee a new pattern file on a daily 
basis, is telling it to do an incremental scan on a weekly basis a waste 
because it's going to do a full scan anyway (new pattern file)?  She said 
yes.

Anyone's experience differ from her observations?  Granted, her 
observations take more time, but currently I agree with the concept.

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com

_______________________________________________
This is the Lotus Domino on the iSeries / AS400 (Domino400) mailing list
To post a message email: Domino400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/domino400
or email: Domino400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/domino400.


_______________________________________________
This is the Lotus Domino on the iSeries / AS400 (Domino400) mailing list
To post a message email: Domino400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/domino400
or email: Domino400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/domino400.