Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

For some time now, I've configured the anti-virus software on the systems on my network to only scan files on write, not on read, on-top of a regular full scan overnight.

I base this on the assumption that for malware to exist on the drive, it must have been written there at some point and so scanning again on every read is a waste of resources.

Note that this policy I do not apply to removable drives.

Is there anything significant I'm overlooking with this approach? I'm not looking for opinions, rather ways that such protection could be circumvented which I haven't considered.

share|improve this question

1 Answer 1

Normally most antiviruses and enterprises I have seen set the antivirus to atleast do a Scan on Read with Scan on Write disabled.

The logic here is that (Atleast what I feel):

  1. You can have an removable thumb drive added to the system that can contain malware.
  2. You may add a hard drive to the system / machine which may already have data written to the drive.
  3. Someone can add data to a laptop / machine in an offline mode using Live CD etc and it will be executed once OS boots.
  4. One can safeguard against malware in media like CD/DVD with Scan on Read only.
share|improve this answer
    
The bootable media point is moot - if someone has physical access, they can add malware to their heart's content unless the drive is encrypted - which would prevent files from being added via removable media anyway. The others are good points (though Graham implies scan on read is enabled for removable media). –  Bob Nov 23 '12 at 15:42
    
@Bob I agree partially. You may not know that the media has malware. If you do not enable Scan on Read, and if autorun is enabled, you may unknowingly infect the PC. –  Ganesh R. Nov 23 '12 at 15:45
    
Uh, sorry, typo. I meant encryption would prevent files from being added via bootable media (live CD, etc.), not removable. –  Bob Nov 23 '12 at 16:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.