Trend Micro's Scan mail, DBSCAN and incremental scanning

[rob@xxxxxxxxx]

I just got off the phone with someone at Trend's support, and since it 
seemed that English was not her primary language I wanted to run this by 
the list to see if her statement was not what other's have observed.

The reason that I originally called was that if I use incremental scanning 
for DBSCAN would I miss viruses that a newer pattern would find.  For 
example I scan database xyz.nsf with pattern file 200 and it says it is 
clean.  However, since pattern file 200 is old it missed the gooneygoohoo 
virus.  Now, I've made no changes to xyz.nsf at all.  I perform an 
incremental scan on xyz.nsf with the latest and greatest pattern file 
(that will catch the gooneygoohoo virus), will it skip the xyz.nsf 
database since it was already scanned clean?  Her answer was no, since I 
have a newer pattern file, it will not do an incremental scan.

This begs the next question:  Since we check for pattern files 4 times a 
day, and you can pretty much guarantee a new pattern file on a daily 
basis, is telling it to do an incremental scan on a weekly basis a waste 
because it's going to do a full scan anyway (new pattern file)?  She said 
yes.

Anyone's experience differ from her observations?  Granted, her 
observations take more time, but currently I agree with the concept.

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com