Re: libclamav versus clamd
Nick FitzGerald <nick-jd3pj1bJWvoG2Il/[email protected]> Tue, 01 Jun 2004 17:45:17 +1200
| Newsgroups | gmane.comp.security.virus.openantivirus.general |
|---|---|
| Organization | Personal account |
| Message-ID | <40BCC0AD.28453.3C615E33@localhost> |
"Jason Haar" <[email protected]> wrote: > How do Windows online virus scanners work - I bet they run with SYSTEM > privileges... Of course they do -- that is, I think, a consequence (or necessity) of running as a file system filter driver, as is necessary to be "low enough" in the I/O "stack" to see all file system accesses (including memory-mapped files), disinfect, block access, etc. Regards, Nick FitzGerald ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click