Re: Trend Micro's Scan mail, DBSCAN and incremental scanning

[Dave Guerrero <dguerrero@xxxxxxxxxxxx>]

Here is a link to exactly what is talked about.

In short, every time an engine or pattern file is updated, the incremental
scanning is set back to the start.  I still think the setting for
Incremental is good since any day there is not updates, (though rare these
days) only new files are scanned.

http://kb.trendmicro.com/solutions/solutionDetail.asp?solutionID=6042


Thanks,

Dave Guerrero
Solutions Manager
Application Integration Group
--------------------------------------------------------------------
Computech Resources, Inc.
1375 W. Main Avenue
De Pere, WI 54115
Web:  http://www.compures.com
--------------------------------------------------------------------
Phone:  920-336-1387 Ext. 264
Cell:  920-360-7225
Fax:  920-336-7728
e-Mail:  dguerrero@xxxxxxxxxxxx

> I just got off the phone with someone at Trend's support, and since it
> seemed that English was not her primary language I wanted to run this by
> the list to see if her statement was not what other's have observed.
>
> The reason that I originally called was that if I use incremental
scanning
>
> for DBSCAN would I miss viruses that a newer pattern would find.  For
> example I scan database xyz.nsf with pattern file 200 and it says it is
> clean.  However, since pattern file 200 is old it missed the gooneygoohoo

> virus.  Now, I've made no changes to xyz.nsf at all.  I perform an
> incremental scan on xyz.nsf with the latest and greatest pattern file
> (that will catch the gooneygoohoo virus), will it skip the xyz.nsf
> database since it was already scanned clean?  Her answer was no, since I
> have a newer pattern file, it will not do an incremental scan.
>
> This begs the next question:  Since we check for pattern files 4 times a
> day, and you can pretty much guarantee a new pattern file on a daily
> basis, is telling it to do an incremental scan on a weekly basis a waste
> because it's going to do a full scan anyway (new pattern file)?  She said

> yes.
>
> Anyone's experience differ from her observations?  Granted, her
> observations take more time, but currently I agree with the concept.
>
> Rob Berendt
> --
> Group Dekko Services, LLC
> Dept 01.073
> PO Box 2000
> Dock 108
> 6928N 400E
> Kendallville, IN 46755
> http://www.dekko.com
>