Running Multiple Virus Scanners

[Matt Kettler]

At 09:54 AM 3/15/2004, Ron Hahn (Senior Analyst) wrote:
>I've noticed in some of the threads here that some are running multiple
>virus scanners;  For the newbie, is there a particularly good reason for
>this?
>
>I have f-prot running at the moment now on a Cobalt RAQ4;  Would I benefit
>from adding clam (or any other for that matter)?  Obviously there is a
>processing penalty for adding subsequent virus scanners but is there an up
>side??

Upside: Different virus scanners are updated at different times to catch
the "new" viruses. This means that between two virus scanners, sometimes
one will get fresh sigs before the other, and vice versa.

It also provides a bit of "genetic diversity" should a virus ever be
designed to target a specific scanner for evasion.