Loading...

Knowledge Center


VirusScan Enterprise exclusions and hardware paths (physical address versus logical address)
Technical Articles ID:   KB61000
Last Modified:  5/12/2016
Rated:


Environment

McAfee VirusScan Enterprise 8.x

Problem

Under certain circumstances, VirusScan Enterprise (VSE) reports the path of a scan item by its physical address rather than its logical address.

Example: \Device\HardDiskVolume1\Windows\File1.txt rather than C:\Windows\File1.txt


An exclusion using the logical address may not be effective if Windows references an object using its physical address.

If you set an exclusion for File1.txt to avoid a performance issue resulting in timeouts (reported in the On-Access Scan log), you would generally exclude C:\Windows\File1.txt. However, you may subsequently find the exclusion is not effective and timeouts still occur. Viewing the On-Access Scan shows timeouts occurring on physical address: \Device\HardDiskVolume1\Windows\File1.txt.

Cause

This can be caused by factors such as:
  • Disk emulation drivers attaching to Storage Area Networks or Network Area Storage
  • Advanced disk controller cards
  • RAID array disk controllers
  • Windows Volume Mount Points

Solution

VSE scans an object if it is presented as a physical or logical address; therefore, when using exclusions, ensure that you check the On-Access Logs to see if exclusions are effective.

Using the previous example, you set the exclusion for the file C:\Windows\File1.txt as \Device\HardDiskVolume1\Windows\File1.txt to match the entry in the On-Access Scan log.

Rate this document

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.