Optimization Of Kaspersky Anti-Virus Operation - KAPERSKY ANTI-VIRUS 5.7 - FOR LINUX FILE SERVER Administrator's Manual

38
5.2. Optimization of Kaspersky Anti-
Virus operation
To reduce the load on the computer‟s processor, and increase the speed of anti-
virus processing, Kaspersky Anti-Virus offers effective optimization methods.
This section gives a detailed discussion of these features.
The use of the iChecker database and double-level caching of scanned
files.
The application uses several technologies that make it unnecessary to
repeatedly scan a file every time it is accessed and, if possible, restrict the work
to merely comparing it to the existing information about it. The algorithm for
scanning objects (files) for viruses is as follows:
After the primary scan of any file, information about it (name, checksum) is regis-
tered in one of the following databases:

iChecker database – common database that includes information about
scanned non-infected files of selected formats. This database contains
information about objects scanned by kavmonitor and kavscanner.

The cache of scanned files - database that contains information about
files scanned by kavmonitor. The cache consists of two levels. The first
level stores information about clean files that are accessed relatively of-
ten. This cache is located in the kernel module, which considerably re-
duces the time needed to access it. If the application detects data about
the requested file in the first-level cache, it automatically assigns the
Clean status to the object and no further anti-virus scan will be per-
formed. If the first-level cache does not contain the required information, a
search is performed on the second level that contains information about
all scanned files. Both cache databases exist in RAM and will not persist
after the application is closed.
Therefore, if during a scan, information about a file is not added to the iChecker
database (in which case the file is clean or its format is not supported by this
technology), it will be added to the cache.
During each attempt to access a file, a search will be performed first in the first-
level cache, then in the iChecker database and in the second-level cache.
The search is based on the filename. If the file is found in any of the data-
bases, the file information will be compared with the information stored in the
database. If the current state and its description in the database are com-
pletely identical, the file will be deemed unaltered and will not be checked for
viruses.
Kaspersky Anti-Virus ® 5.7 for Linux File Server