Kaspersky Anti-Virus 5.0 SOS

The technologies work in the current versions of Kaspersky Lab Anti-Virus packages the following way (as an example the algorithm of scanning one object is given but this algorithm can be used for any number of objects as well):

• During the first anti-virus scan of the object and its contents for an infected code, the scan sum and some other service parameters of the object are counted, fixed and saved. These parameters define the state of the object by the moment of scan completion.
• The data received during the scan (CRC object, service parameters, date of the first scan) are registered in the object stream (if the object is located on the drive with NTFS file system) and in internal database (if the object is located on the drive with FAT32/NTFS file system).
• During the next anti-virus scan of the object the object data (CRC and service parameters) are compared with the data saved in the stream (if it exists). If there is no stream and data do not coincide, the parameters saved in the data base are scanned. If the data coincide, the object is not scanned.

The object is not rescanned by the repeated scan (if the Antivirus databases are not updated): - if the object was scanned earlier with “more powerful” settings (e.g.  “scan all” instead of “scan infectable objects”)

- if the anti-virus databases on the PC had been released earlier than the object was scanned
- if the period between the first and the last scan is more than the “quarantine period”.

Note: after the anti-virus database update the previously described algorithm of actions is repeated. But if during the “quarantine period” of the CRC object none of the service parameters has been changed then during the next scan CRC and service parameters are only compared irrespective of the anti-virus databases installed. If the “quarantine period” is over and a mismatch is detected when comparing CRC and service parameters, the “quarantine period” starts from the beginning. And the previously described algorithm of actions is repeated.


Note: For various modes of the Anti-Virus the “quarantine period” is different. The necessary information is given below:

Maximum protection: 365 days
Recommended: 14 days
High speed: 14 days