Universe is getting flagged as a virus

Gil,

I haven't personally seen anything flag UniVerse as a virus for well over a decade - could you share what AV package and version you are using aloing with the associated reports in the AV software logs please?

Regards

JJ 

------------------------------
John Jenkins
Thame, Oxfordshire
------------------------------

Gil,

Just as a random thought - if you check the UnIVerse services in the Windows "Services" applet, what user are they running as and do they all start OK?

Regards

JJ 

Upon further clarification from our installation team, the question is not about AV flagging UV as a virus. 

We are whitelisting our UV accounts (which contain thousands of files) to exclude them from On Access scanning by the AV program. Our concerns are: 1) Security, since these accounts are not scanned we risk opening ourselves up for viruses, crypto, and malware, 2) Performance, if we do interrupt each file access, this significantly impacts UV performance.

What is considered "Best Practices" for UV?

Gil,

UniVerse accounts do not contain any executables so can safely be excluded from scans, and this is normal practise. The 'bin' subdirectory under %UVHOME% should be scanned, as should the 'unishared' directory as these contain executables. On WIndows these default to sub-directories under the UniVerse installation directory.

If database files are scanned then performance will degrade significantly, and in a worst case every file will be read into memory and scanned each time it is opened, each time a record is written or deleted and sometimes every time a record is read. This is a massive overhead regardless of the file sizes, and if the files are very large then a complete system can be dragged to a halt as hundreds of Gb of files are constantly being read into physical memory and scanned on almost every OPEN/READ/WRITE/DELETE operation.  Even in a  'best case' scenario the impact s likely to be severe.

To summarise: The normal practise is not to scan UniVerse accounts with only the few directories that contain executables being scanned.

Hoping this helps.

Regards,

JJ