Product guide

• The file has not been cached.
• The file has not been excluded.
• The file has not been previously scanned.
NOTE: The on-demand scanner uses heuristics to check for suspicious files, if you
configure Artemis. For details, see How Artemis works .
2 If the file, folder, or disk meets the scanning criteria, it is scanned by comparing the
information in the file to the known virus signatures in the currently loaded DAT files.
• If it is clean, the result is cached and the next item is checked.
• If it contains a threat, the configured action is taken. For example:
• If it needs to be cleaned, that process is determined by the currently loaded DAT
files.
• The results are recorded in the activity log if the scanner was configured to do so.
• In the On-Demand Scan Progress dialog, the information describing the memory,
file, folder, or disk name and the action taken is displayed.
3 If the memory, file, folder, or disk does not meet the scanning requirements, it is not
scanned and the scanner continues until all of the data is scanned.
On-demand scanning methods and how they are defined
The on-demand scanner uses in-memory-process scanning and incremental or resumable
scanning.
In-memory-process scanning
This method examines all active processes prior to running the on-demand scan task. Any
detected potentially unwanted process is highlighted and the process is stopped. This means
that a single pass with the on-demand scanner removes all instances of a potentially unwanted
program.
Incremental or resumable scanning
This method allows you to limit when on-demand scan activity occurs, and still scan the entire
system in multiple sessions. Incremental scanning can be set by adding a time limit to the
scheduled scan. The scan stops when the time limit is reached. The next time this task starts,
it continues from the point in the file and folder structure where the previous scan stopped.
How scanning of remote storage works
Remote storage data is hierarchical, with two defined levels of storage.
The two levels of storage:
• Upper level, local storage — Includes the NTFS disk volumes of the computer running
Remote Storage on Windows 2000 Server.
• Lower level, remote storage — Located on the robotic tape library, or a standalone tape
drive connected to a server computer.
Remote storage automatically copies eligible files on your local volumes to a tape library, then
monitors space available on the local volumes. File data is cached locally so that it can be
accessed quickly as needed. When necessary, remote storage moves data from the remote
Part II - Detection: Finding Threats
Scanning items on-demand
63McAfee VirusScan Enterprise 8.8 Product Guide