Re: Ransomware on Power

["Larry \"DrFranken\" Bolhuis" <midrange@xxxxxxxxxxxx>]

I will tell you why *I* don't like it. (And I agree with Steve by the way.)

FIRST it means you have to share the entire IFS or you can't scan it. 
That alone should scare you.

Further, if you want the AV program to be able to fix the files then the 
scan AND the user running the scan needs to be able to write to your 
entire IFS. That gives me the heebie jeebies just writing it!

SECOND it's a ton of I/O to read every file on there and guess what, the 
vast majority of them didn't change so why do that every day?

THIRD it's a 'how often' scan? Once a day? So if you have a file in 
there that's updated 8 seconds after the daily scan it's sitting there 
contagious for nearly 24 hours before it gets caught. AND if you make 
the scan more frequent you just make the I/O load worse and worse.

IBM Provides tooling to enable virus scanning at write time. Fabulously 
better idea. Do that.

	- L


On 1/21/2021 5:38 PM, Patrik Schindler wrote:
> Hello Steve,
>
> Am 21.01.2021 um 21:05 schrieb Steve Pitcher <SPitcher@xxxxxxxxxxxx>:
>
> > Scanning the IFS with a Windows AV tool is bad news. Don’t. Bad idea and should be ignored.
>
> I’m interested in your reasoning about your statement.
>
> :wq! PoC