Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 6 subscribers
  • Views 1853 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Downloaded Files

rmgraci

The on-access scanner really seems like overkill for my needs.  For example, why do I need to scan a bunch of files I access every day?  I really only want to scan files that I download.  Is there a way to scan ONLY a single folder, like Downloaded, and exclude the rest of my Mac?

Additionally, Custom Scans work fine, but I can't find any kind of scheduling feature.  I would rather scans run in the middle of the night, while no one is using the computer to notice any slowdown.  How do I set this up?

Thanks!

:1003991


This thread was automatically locked due to age.
Parents
  • 0

    I'll leave it up to other forum users to provide unbiased results of the scanner tests, but I'll provide some feedback on the other questions :)

    The on-access scanning "hook" is actually a "subscription" to kernel broadcasts -- as such, the OS is handling the information dispatch, not the AV software.  As a result, there should be no performance change as a result of having this installed or not (things happen, so I can't guarantee this in all cases).  With on-access disabled, the link to the dispatch is broken, so no additional code should be run -- but the software itself is still installed and loaded.  On-access also does intelligent caching, so if a file has not changed since the last on-access scan, the first thing checked when the scanner receives a file activity notification is whether the file has changed state; and if it hasn't, it won't re-scan.

    So, the short answer is: you will still have on-access code loaded at system boot and user login, but the on-access portion should be completely dormant.

    Please share your results between fopen performance in the scenarios listed, including OS, hardware specs, SAV product and engine version -- and hopefully others will share theirs as well.

    :1004059
Reply
  • 0

    I'll leave it up to other forum users to provide unbiased results of the scanner tests, but I'll provide some feedback on the other questions :)

    The on-access scanning "hook" is actually a "subscription" to kernel broadcasts -- as such, the OS is handling the information dispatch, not the AV software.  As a result, there should be no performance change as a result of having this installed or not (things happen, so I can't guarantee this in all cases).  With on-access disabled, the link to the dispatch is broken, so no additional code should be run -- but the software itself is still installed and loaded.  On-access also does intelligent caching, so if a file has not changed since the last on-access scan, the first thing checked when the scanner receives a file activity notification is whether the file has changed state; and if it hasn't, it won't re-scan.

    So, the short answer is: you will still have on-access code loaded at system boot and user login, but the on-access portion should be completely dormant.

    Please share your results between fopen performance in the scenarios listed, including OS, hardware specs, SAV product and engine version -- and hopefully others will share theirs as well.

    :1004059
Children
No Data