Virus Scan Bottlenecks

[Devilpapaya]

Hello all,

I work at a computer help desk that serves the student population of the University I attend. We see a huge number of machines that have become almost inoperable due to viruses; and we regularly have a queue of 20+ machines just waiting for virus scans.

Depending on the computer, the virus scans we run (spybot, combofix, malwarebytes, sophos AV, AVG) can take from a few minutes to hours to (in the worst cases) over a day to run.

My question to you: Does a virus scan bottle neck based on system resources (cpu speed, RAM, etc) or is the HDD the only real bottleneck (speed/total size/used space).

I'm posting here as I begin my research for a report to my supervisors about the possibility of a powerful dedicated machine to plug infected hard drives into to run scans from.

Thanks in advance, I'll post any additional information I find.

 

[gaidensensei]

The most offsetting factor with spyware is the various forms and variants they are in, just my opinion. Each one operates in different manner of another, so it's hard to lump them all as the same thing in terms of program execution.

If you plan to create a system solely for accepting external drives for scanning and quarantine purposes, I don't see the issue here. The only factors should be the input drive's size / spread of the infection.

 

[RadiclDreamer]

Hard drive speed and amount of data stored. A machine with several drive capacity may make your queue go quicker

 

[Gunbuster]

Mostly drive speed. I would go in and nuke all the windows temp files before scanning. It also depends on if your antivirus is also running while you scan with utility such as malwarebytes, if you have Symantec SEP with App con. turned on it will check every executable file so you are essentially scanning the file two (or three) times.

C:\Temp, C:\Windows\temp\, C:\Documents and Settings\User Name\Local Settings\Temp, Run disk cleanup, ...