Norton Internet Security / Norton AntiVirus

[Plankton]

Hi:

I am performing a Full System Scan and working on my system while scanning is active.

Therefore, If I download, install, configure a new program, or even visit various websites, how is NIS 2010 taking these into account furing the scan time? Does NIS just use the RT engine for immediate threats, or does it go back and check the newly installed files?

Thanks.

[Tech83 Super Phishing Phryer]

Hi! Plankton,

The NIS Real Time protection is exactly that; it operates in real time.  Real Time processes have a higher interrupt priority than normal processes do.  So the system processor will respond to requests made by a real time process before it will a normal process. The NIS on demand scanner is a normal process.  The NIS Real Time scanner will scan files as they are installed, downloaded, opened, and any websites that you may visit for malware as they go through  system memory.  Real time processes have a separate area of system memory they use than normal processes.  These processes happen so fast that on today's PC's the user will more than likely never notice what is going on; especially those with multi-core processors.  So I believe it safe to say that both the real time and normal processes can run simultaneously.

[Plankton]

Hi Tech83:

Sounds reasonable!

Could anyone verify Tech83's statement as fact?

Thanks.

[dbrisendine Norton Fighter · Accepted solution]

Auto-Protect is a Real Time process and scans EVERY file action on your system.  It is separate from any other Norton process or system process.  The On Demand scans (be they manual or Idle Time scans) are Normal Time processes.  Both can run at the same "time" on your system and do not interfere with each other.

To answer your question of whether or not Norton goes back and scans your newly installed file via the Full System Scan (Normal Time process), it would depend on where on your hard drive the installed file "lay" and where on your drive / file structure the scan is progressing currently.  If the file system is sequential in structure and the FSScan has not scanned the Program Files folder, then the newly installed files would be scanned with the FSScan (assuming the installation places the new files in Program Files folder).  If the FSScan has progressed past the Program Files folder (and your file system is sequential) then the files will not be scanned again.  If the file system is not sequential in nature (we are talking about the actual structure of the data on the hard drive), then the FSScan will scan whatever files it finds as it progresses throught your disk and will scan the new installation as it will have been added wherever there is disk space to place data (most likely towards the end of the previous data on the disk).

In either case, you are protected by the Auto-Protect feature of Norton in Real Time.

[Plankton]

Hi dbrisendine:

Thanks for your comment! What you present is logical.

I am just curious as to what would happen to detection (in theory) if I ran a defrag and a Full System Scan simultaneously.

That would be an interesting scenario.

Message Edited by Plankton on 10-23-2009 10:24 AM

[reese_anschultz]

---

Plankton wrote:

 

I am just curious as to what would happen to detection (in theory) if I ran a defrag and a Full System Scan simultaneously.

---

Defrag simply moves the bits of the file around on the disk and, other than performance, shouldn't affect the scan in any way.