>
> Other experienced server admins have told me that Norton AV slows
down the performance of a Web server to an unacceptable degree.
That might very well be an implementation / configuration issue.
For instance, it can make quite some difference if you scan files
on read or on write on a webserver that is predominantly read-only.
> In my estimation, AV software does not do a great job of protecting Web servers, since Web servers are not running E-mail clients and that is how most viruses seem to be spread these days. I do not believe AV software will protect against worms attacking newly discovered security holes in Windows, IIS, or SQL Server.
That depends on the type of exploit. As long as it is a
memory-only worm, virusscanners will not find them: processes
can't read eachothers memory. As soon as there is an attempt to
install something or change registry keys or something,
virusscanners might help.
> My recommendation is that, instead of real-time virus protection, servers be periodically scanned during off-peak hours, possibly using a different machine on the same network. Does anyone disagree with this?
I wonder how effective it would be to run a virusscanner that
scans the /web-inf/temp dir only. All files uploaded through HTTP
pass through there.
> Virus software has been running on many of the servers in my area for years, and the logs indicate that no servers have ever been infected, even though many viruses have spread through our desktop machines.
I don't run virusscanners on webservers, they have dozens of
virusses stored on them, but they are not infected :-)
Jochem
[Todays Threads] [This Message] [Subscription] [Fast Unsubscribe] [User Settings] [Donations and Support]
