Path of a scan item reported by its physical address instead of logical address

Technische Artikel ID: KB61000
Zuletzt geändert am: 6/26/2020

Umgebung

McAfee VirusScan Enterprise (VSE) 8.x

Problem

Under certain circumstances, VSE reports the path of a scan item by its physical address rather than its logical address.

Example: \Device\HardDiskVolume1\Windows\File1.txt rather than C:\Windows\File1.txt

An exclusion using the logical address might not be effective if Windows references an object using its physical address.

If you set an exclusion for File1.txt to avoid a performance issue resulting in timeouts (reported in the On-Access Scan log), you would generally exclude C:\Windows\File1.txt. But, you might later find the exclusion is not effective and timeouts still occur. Viewing the On-Access Scan shows timeouts occurring on physical address: \Device\HardDiskVolume1\Windows\File1.txt.

Ursache

The following factors can cause this issue:

Disk emulation drivers attaching to Storage Area Networks or Network Area Storage
Advanced disk controller cards
RAID array disk controllers
Windows Volume Mount Points

Lösung

VSE scans an object if it is presented as a physical or logical address. So, when using exclusions, ensure that you check the On-Access Logs to see if exclusions are effective.

Using the previous example, you set the exclusion for the file C:\Windows\File1.txt as \Device\HardDiskVolume1\Windows\File1.txt to match the entry in the On-Access Scan log.

Themenbezogene Informationen

If you suspect you might encounter physical addresses and want to discover physical to logical mappings in your Windows system, use the WinObj tool provided by Sysinternals.

See: http://technet.microsoft.com/sysinternals/bb896657.aspx

Start WinObj.
In the left panel, navigate to the GLOBAL?? entry.
In the right panel, locate your logical disk letters, showing the physical to logical mapping.

Betroffene Produkte

Configuration
VirusScan Enterprise 8.8

Sprachen:

Dieser Artikel ist in folgenden Sprachen verfügbar:

German
English United States
Spanish Spain
French
Italian
Japanese
Korean
Dutch
Portuguese Brasileiro
Chinese Simplified
Chinese Traditional

Technisches Glossar

Glossarbegriffe hervorheben

Im technischen Glossar werden Fachbegriffe erklärt.

Path of a scan item reported by its physical address instead of logical address

Umgebung

Problem

Ursache

Lösung

Themenbezogene Informationen

Betroffene Produkte

Sprachen:

Technisches Glossar

Title

Title

Empfohlene Lösungen

Unser Portfolio kennenlernen

Sicherheitsergebnisse

Branchen

Produkte

Empfohlene Lösungen

Unser Portfolio kennenlernen

MVISION-Produkte

Services und Schulungen

Bedrohungsforschung

Unsere Forscher

Bedrohungslage-Dashboard

Tools

Kontakt

Ressourcen

Downloads

Produkthilfe

Folgen Sie uns

Durchsuchen

Unser Unternehmen

Unsere Bemühungen

Weitere Ressourcen

Jobs

Partnerschaften

Path of a scan item reported by its physical address instead of logical address

Umgebung

Problem

Ursache

Lösung

Themenbezogene Informationen

Betroffene Produkte

Sprachen:

Technisches Glossar

Wählen Sie Ihre Region

Title

Title