VirusScan Enterprise exclusions and hardware paths (physical address versus logical address)

Technical Articles ID: KB61000
Last Modified: 5/12/2016

Environment

McAfee VirusScan Enterprise 8.x

Problem

Under certain circumstances, VirusScan Enterprise (VSE) reports the path of a scan item by its physical address rather than its logical address.

Example: \Device\HardDiskVolume1\Windows\File1.txt rather than C:\Windows\File1.txt

An exclusion using the logical address may not be effective if Windows references an object using its physical address.

If you set an exclusion for File1.txt to avoid a performance issue resulting in timeouts (reported in the On-Access Scan log), you would generally exclude C:\Windows\File1.txt. However, you may subsequently find the exclusion is not effective and timeouts still occur. Viewing the On-Access Scan shows timeouts occurring on physical address: \Device\HardDiskVolume1\Windows\File1.txt.

Cause

This can be caused by factors such as:

Disk emulation drivers attaching to Storage Area Networks or Network Area Storage
Advanced disk controller cards
RAID array disk controllers
Windows Volume Mount Points

Solution

VSE scans an object if it is presented as a physical or logical address; therefore, when using exclusions, ensure that you check the On-Access Logs to see if exclusions are effective.

Using the previous example, you set the exclusion for the file C:\Windows\File1.txt as \Device\HardDiskVolume1\Windows\File1.txt to match the entry in the On-Access Scan log.

Related Information

If you suspect you may encounter physical addresses and want to discover physical to logical mappings in your Windows system, use the WinObj tool provided by SysInternals.

See: http://technet.microsoft.com/sysinternals/bb896657.aspx

Launch WinObj.
In the left panel, navigate to the GLOBAL?? entry.
In the right panel, locate your logical disk letters, showing the physical to logical mapping.

Affected Products

Configuration
VirusScan Enterprise 8.8

Languages:

This article is available in the following languages:

German
English United States
Spanish Spain
French
Italian
Japanese
Korean
Dutch
Portuguese Brasileiro
Chinese Simplified
Chinese Traditional

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

VirusScan Enterprise exclusions and hardware paths (physical address versus logical address)

Environment

Problem

Cause

Solution

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Featured Solutions

Explore Our Portfolio

Security Outcomes

Industries

Products

Featured Solutions

Explore Our Portfolio

MVISION Products

Services & Training

Threat Research

Our Researchers

Threat Landscape Dashboard

Tools

Contact Us

Resources

Downloads

Product Help

Connect with Us

Explore

Our Company

Our Efforts

Other Resources

Careers

Partnerships

VirusScan Enterprise exclusions and hardware paths (physical address versus logical address)

Environment

Problem

Cause

Solution

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title