1

I have seen a lot on free online virus scanners available online lately. I was considering trying one of them out, but I have a question. If I have company word documents, excel spreadsheets, etc on my computer, do these scanners just take a copy of everything on my hard drive, put it on their server, and search through them? Or do they just use virus definitions and scan through my computer without taking a copy of all my data?

6
  • They scan the files on your computer. It would takes days to upload the data on your typical desktop if they uploaded your files to your server. Why do you have company documents on your personal computer?
    – Ramhound
    Nov 13, 2012 at 17:03
  • ^ How do they scan the files without uploading?
    – pratnala
    Nov 13, 2012 at 17:08
  • The use a web application and upload their database to your computer.
    – Ramhound
    Nov 13, 2012 at 17:16
  • So they have a database of dangerous code, the database is sent to my computer, and then a script scans through the computer, and compares the code of the files on my computer to the database?
    – JosephG
    Nov 13, 2012 at 17:24
  • @user185812 - Basically thats the idea. If you are worried about company documents you shouldn't have them on your personal computer in the first place, or at the very least, exclude them from being scanned.
    – Ramhound
    Nov 13, 2012 at 17:40

2 Answers 2

1

It depends which service you use, and how they are developed. For example, Trend Micro's House Call – Free Online Virus Scan is an "online virus scan" in the sense that you still have to download a program, but it just gets the virus definitions online (see the system requirements, "HouseCall 7.1 is browser independent."). Bitdefender also appears to have a true "online" browser-based virus scanner, not requiring you to actually install anything.

However, other sites, like Virus Total, are indeed true online virus scanning services where you can upload an actual file to be tested remotely on their servers. While I can't speak for other services, I know that Virus Total will scan the file in a sandboxed computer using various anti-virus programs (using the latest definitions), and deliver the results per scanner. This differs from the above two methods in that, the scanning is done on a remote server (requiring the entire file's contents to be uploaded), versus being done locally (requiring the scanner's virus definitions to be downloaded).

1

do these scanners just take a copy of everything(?)

No

Even with the current fastest internet it would take a very long time to upload all those files for examination. As such, this is not how online scanners work.

Or do they just use virus definitions ... without taking a copy of all my data?

Technically yes, but not quite.

In reality they download an applet (a small software) to your computer and run that to scan your files. Most of these scanners only download the engine that does the actual work of scanning files while the definitions still reside in their server. Which is why they are called "online scanners"; because they require an internet connection.

Not to worry though because the scanner isn't actually installed. It goes to a temporary location and is automatically deleted after some time.

edit:

How does it compare my files to the definitions?

That question applies to all security scanners. That depends on the engine but for the most part the engine looks for suspicious bits of code using heuristics. When it finds something suspicious it sends a sample of that small part to the server then the server replies back if it really is a virus. This is faster as opposed to sending all of your files to the server.

Scanning engines that do not use heuristics however, download a "short definition file". If something is not found in that short definition file, it asks for more "short definition files" from the server. This sounds pointless because it just ends up downloading all of the short definition files available in small chunks.

Also, I forgot to mention those online scanners that accept a file for upload. In that case a file is uploaded then the server scans the file as a normal anti-virus would.

5
  • So if the definitions are still on a server, how does it compare my files to the definitions?
    – JosephG
    Nov 13, 2012 at 17:46
  • That question applies to all security scanners. That depends on the engine but for the most part the engine looks for suspicious bits of code using heuristics. When it finds something suspicious it sends a sample of that small part to the server then the server replies back if it really is a virus. This is faster as opposed to sending the whole file to the server. Scanning engines that do not use heuristics however, download a short definition file. If something is not found in that short definition file, it asks for more "sdf" from the server. Should I edit my answer to include this? Nov 13, 2012 at 17:53
  • @Subaru Yes, you should probably edit your answer to include the additional information. Nov 13, 2012 at 18:08
  • @SubaruTashiro some virus scanners (e.g. Virus Total) run on the server and not locally (i.e. you upload your file, and it's scanned remotely). Nov 13, 2012 at 18:56
  • @Breakthrough yes, i've edited my answer to include that bit. Thank you. If you wish to do so, you may edit it yourself. I don't mind. Nov 13, 2012 at 19:02

Not the answer you're looking for? Browse other questions tagged .