Reply to thread

Message

<blockquote data-quote="Obsession" data-source="post: 1104409" data-attributes="member: 117396">It&#039;s not that simple. When you say &quot;only scan new files&quot;, consider the following scenario: you download a file, the AV doesn&#039;t find anything. You just leave the file in the downloads folder. Then the AV updates its signature, which COULD find a virus in this file, but since it&#039;s not newer, it won&#039;t be scanned anymore. Even more stupidly, whitelisted files are usually not scanned when they&#039;re executed - the file is clean, it&#039;s already been scanned.The hybrid detection you mentioned has nothing to do with on-access or on-execution. One is HOW malware is detected, the other is WHEN malware is detected.And in that case, it&#039;s usually sufficient if the malware is detected BEFORE it&#039;s executed.These are different strategies, each with its own specific advantages and disadvantages. This is simply not a black and white issue, a lot of people have already racked their brains over it.For example, I don&#039;t want an AV that constantly scans the same files and wastes my power and time.Kaspersky is a completely different issue (in relation to UltraAV), but even there and in ESET there is the option to set it to on-execution (which I have always done, I used to be with Kaspersky for years, then with ESET until six months ago and now with F-Secure and, as a result of a campaign, also with McAfee - but different PCs). With F-Secure (which many people consider to be very easy) I do notice the on-access check. But that&#039;s another story.</blockquote>

[QUOTE="Obsession, post: 1104409, member: 117396"] It's not that simple. When you say "only scan new files", consider the following scenario: you download a file, the AV doesn't find anything. You just leave the file in the downloads folder. Then the AV updates its signature, which COULD find a virus in this file, but since it's not newer, it won't be scanned anymore. Even more stupidly, whitelisted files are usually not scanned when they're executed - the file is clean, it's already been scanned. The hybrid detection you mentioned has nothing to do with on-access or on-execution. One is HOW malware is detected, the other is WHEN malware is detected. And in that case, it's usually sufficient if the malware is detected BEFORE it's executed. These are different strategies, each with its own specific advantages and disadvantages. This is simply not a black and white issue, a lot of people have already racked their brains over it. For example, I don't want an AV that constantly scans the same files and wastes my power and time. Kaspersky is a completely different issue (in relation to UltraAV), but even there and in ESET there is the option to set it to on-execution (which I have always done, I used to be with Kaspersky for years, then with ESET until six months ago and now with F-Secure and, as a result of a campaign, also with McAfee - but different PCs). With F-Secure (which many people consider to be very easy) I do notice the on-access check. But that's another story. [/QUOTE]

Verification