I have seen a lot on free online virus scanners available online lately. I was considering trying one of them out, but I have a question. If I have company word documents, excel spreadsheets, etc on my computer, do these scanners just take a copy of everything on my hard drive, put it on their server, and search through them? Or do they just use virus definitions and scan through my computer without taking a copy of all my data?
closed as not constructive by Breakthrough, TFM, Gaff, ChrisF, Simon Sheehan Nov 14 '12 at 1:32
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.
It depends which service you use, and how they are developed. For example, Trend Micro's House Call – Free Online Virus Scan is an "online virus scan" in the sense that you still have to download a program, but it just gets the virus definitions online (see the system requirements, "HouseCall 7.1 is browser independent."). Bitdefender also appears to have a true "online" browser-based virus scanner, not requiring you to actually install anything.
However, other sites, like Virus Total, are indeed true online virus scanning services where you can upload an actual file to be tested remotely on their servers. While I can't speak for other services, I know that Virus Total will scan the file in a sandboxed computer using various anti-virus programs (using the latest definitions), and deliver the results per scanner. This differs from the above two methods in that, the scanning is done on a remote server (requiring the entire file's contents to be uploaded), versus being done locally (requiring the scanner's virus definitions to be downloaded).
do these scanners just take a copy of everything(?)
Even with the current fastest internet it would take a very long time to upload all those files for examination. As such, this is not how online scanners work.
Or do they just use virus definitions ... without taking a copy of all my data?
Technically yes, but not quite.
In reality they download an applet (a small software) to your computer and run that to scan your files. Most of these scanners only download the engine that does the actual work of scanning files while the definitions still reside in their server. Which is why they are called "online scanners"; because they require an internet connection.
Not to worry though because the scanner isn't actually installed. It goes to a temporary location and is automatically deleted after some time.
How does it compare my files to the definitions?
That question applies to all security scanners. That depends on the engine but for the most part the engine looks for suspicious bits of code using heuristics. When it finds something suspicious it sends a sample of that small part to the server then the server replies back if it really is a virus. This is faster as opposed to sending all of your files to the server.
Scanning engines that do not use heuristics however, download a "short definition file". If something is not found in that short definition file, it asks for more "short definition files" from the server. This sounds pointless because it just ends up downloading all of the short definition files available in small chunks.
Also, I forgot to mention those online scanners that accept a file for upload. In that case a file is uploaded then the server scans the file as a normal anti-virus would.