<br><br><div class="gmail_quote">On Mon, Sep 3, 2012 at 3:33 AM, Tim <span dir="ltr"><<a href="mailto:ignored_mailbox@yahoo.com.au" target="_blank">ignored_mailbox@yahoo.com.au</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div id=":2xe">The thing is, that anti-virus is always after-the-fact. The damage has<br>
been done,</div></blockquote></div><br>Huh? No. Most modern anti-virus apps (even for Linux) include "on-access" scanning so that the file is identified as infected (by signature, heuristics, whatever) BEFORE being loaded.<br clear="all">
<br>So the file is "quarrantined" (renamed or moved to a special folder, usually) and cannot harm the system, as it´s never executed.<br><br>The drawback used to be that on-access scanning required use of the ´dazuko´ kernel module... which back in the 2.4 kernel days** meant lots of hair pulling and which nowadays was last updated on early 2011 but looks orphaned since 3/2011 and looking for a new maintainer as per notice on its wiki* <br>
<br>No idea if newer Linux AVs are using other tricks for on-access file scanning....<br><br>FC<br>* <a href="http://dazuko.dnsalias.org/wiki/index.php/Main_Page">http://dazuko.dnsalias.org/wiki/index.php/Main_Page</a><br>
** <a href="http://pages.citebite.com/y4w7g6v8looq">http://pages.citebite.com/y4w7g6v8looq</a><br>