RE: Why NOT to disable Real Time Antivirus on Servers

From: Anton Muthu Kumar B (InfoSec) - CTD, Chennai (antonmk_at_hcltech.com)
Date: 11/03/05

  • Next message: Kirk Brady: "RE: remote desktop question" 
    To: <george.peek@gmx.net>, <security-basics@securityfocus.com>
Date: Thu, 3 Nov 2005 12:20:10 +0530

    Hi George,

    If the character of the virus is only to be multiplied, then having real
    time protection enabled could introduce marginal performance degradation.
    But practically, viruses are basically meant not only for multiplication but
    they are introduced with destructive intent which would make the server
    crash or some times Denial Of Service. When the Server is un-available what
    will be the role of performance?

    Thanks & Regards
    Anton

    DISCLAIMER
    This message and any attachment(s) contained here are information that is
    confidential, proprietary to HCL Technologies and its customers. Contents
    may be privileged or otherwise protected by law. The information is solely
    intended for the individual or the entity it is addressed to. If you are not
    the intended recipient of this message, you are not authorized to read,
    forward, print, retain, copy or disseminate this message or any part of it.
    If you have received this e-mail in error, please notify the sender
    immediately by return e-mail and delete it from your computer.

    -----Original Message-----
    From: george.peek@gmx.net [mailto:george.peek@gmx.net]
    Sent: Wednesday, November 02, 2005 11:04 PM
    To: security-basics@securityfocus.com
    Subject: Why NOT to disable Real Time Antivirus on Servers

    Greetings,

    An Engineer and I are having an argument about keeping Real Time Antivirus
    disabled on servers.

    His point is keeping Real Time Antivirus Enabled on servers such as the
    Exchange Server takes a huge performance hit on the server.

    My argument is that keeping real time antivirus software disabled defeats
    the purpose of PREVENTING a server from being infected in the first place.
    Once it is infected, it is all too late already. The antivirus software is
    enabled on the workstations.

    He argues that since all of the workstations have the antivirus enabled,
    then there is no way for the virus to get in.

    Mine argument that a virus can still get in through other means. I need
    examples and case studies to refer to.

    I would like to find different case studies or scenarios where the real time
    antivirus was disabled on the servers, enabled on the PCs, and the company
    still got infected. Also, would like to find solutions to enabling real time
    scan and stream lining it so it does not affect the Exchange Server as bad.

    Would someone point me in the right direction or post potential case
    studies.

    Please post or email me.

    George.peek@gmx.net

    Thank You

  • Next message: Kirk Brady: "RE: remote desktop question"

    Relevant Pages

    • Re: Strange Entry in Proxy Log
      ... You can run real time virus scanning on the server, ... I ran a virus scan and it found 2 viruses. ... > had read a while back that you shouldn't run real time scanning on the ...
      (microsoft.public.backoffice.smallbiz)
    • RE: Why NOT to disable Real Time Antivirus on Servers
      ... If your server is not protected, then over time one can deduce that your ... server will get infected at some point with multiple virus and worms. ... An Engineer and I are having an argument about keeping Real Time Antivirus ...
      (Security-Basics)
    • RE: Why NOT to disable Real Time Antivirus on Servers
      ... Run a front end server that does the anti-virus checking and then passes ... Why NOT to disable Real Time Antivirus on Servers ... An Engineer and I are having an argument about keeping Real Time ... Exchange Server takes a huge performance hit on the server. ...
      (Security-Basics)
    • RE: Why NOT to disable Real Time Antivirus on Servers
      ... but it is easy to overlook attack vectors for malware. ... Are you running an SMTP service on the server that could allow malware ... Why NOT to disable Real Time Antivirus on Servers ... > An Engineer and I are having an argument about keeping Real Time ...
      (Security-Basics)
    • RE: Why NOT to disable Real Time Antivirus on Servers
      ... We don't run an anti-virus scanner on the exchange server and it has not ... Why NOT to disable Real Time Antivirus on Servers ... server will get infected at some point with multiple virus and worms. ...
      (Security-Basics)