Sav32cli, Windows 7/Vista and NTFS junctions

Hello Steve,

which version of SAV32CLI do you use? Regarding symlinks I'm only aware of this article. But it doesn't say that the scan is looping - and I've seen this neither on XP (client has several junctions mainly for testing) nor on Win7. Make sure you run it as administrator (and that UAC doesn't interfere). AFAIK there is no applicable option - but that's gleaned from the help.

Christian 

Steve,

Did you (or anyone) ever happen to find a workaround for this issue?  I'm experiencing the same problem with the April build of SAV32CLI.  I used the -ns switch in order to see what files were being scanned and it just seems to loop between the Application Data junctions.  I also tried building exclusions in but I have been unable to get it to work so far.

Thanks,

Tim

Hi all,

I found a way to deal with those junctions. Unfortunately, you have to add exclusions for each of the locations into the SAV32CLI command.  I've had some luck when adding these exclusions to the scan. Turns out I was configuring the previous exclusions wrong, haha.

-exclude "C:\Users\%username%\Application Data" "C:\Users\%username%\Cookies" "C:\Users\%username%\Local Settings" "C:\Users\%username%\My Documents" "C:\Users\%username%\NetHood" "C:\Users\%username%\PrintHood" "C:\Users\%username%\Recent" "C:\Users\%username%\SendTo" "C:\Users\%username%\Start Menu" "C:\Users\%username%\Templates" "C:\Users\%username%\AppData\Local\Application Data" "C:\Users\%username%\AppData\Local\History" "C:\Users\%username%\AppData\Local\Temporary Internet Files" "C:\ProgramData\Application Data" "C:\ProgramData\Desktop" "C:\ProgramData\Documents" "C:\ProgramData\Favorites" "C:\ProgramData\Start Menu" "C:\ProgramData\Templates"

Good luck!

Tim

Hello Tim,

thanks for sharing your findings. As I said here it always completed within reasonable time. Did you scan the whole C: drive and did you ever wait for it to finish? Guess you used the -ns switch only after you've found that it takes overly long. Wonder why excluding just the logged on user helped though. Were you logged on as Administrator or did you use another admin user? What about UAC?

Christian

Christian,

Sorry about the lack of a response, I thought I subscribed to this as a feed but I guess not! haha.  We never were scanning the C: drive with the command listed above mainly because this was a small segment of our users who constantly got FakeAV infections and also ran with Admin rights (a situation we have been in the process of fixing, haha)  Essentially we used this tool for a quick cleaning purpose and then made sure their Sophos client was updated and started a full scan.  After a little bit of tinkering with Wildcards I was able to setup this:

"C:\Users\*\Application Data" "C:\Users\*\Cookies" "C:\Users\*\Local Settings" "C:\Users\*\My Documents" "C:\Users\*\NetHood" "C:\Users\*\PrintHood" "C:\Users\*\Recent" "C:\Users\*\SendTo" "C:\Users\*\Start Menu" "C:\Users\*\Templates" "C:\Users\*\AppData\Local\Application Data" "C:\Users\*\AppData\Local\History" "C:\Users\*\AppData\Local\Temporary Internet Files" "C:\ProgramData\Application Data" "C:\ProgramData\Desktop" "C:\ProgramData\Documents" "C:\ProgramData\Favorites" "C:\ProgramData\Start Menu" "C:\ProgramData\Templates"

Entering that in the exceptions portion of the script will ignore the junctions for all the users if you want to perform a fullscan on the entire C: drive.  Also you're correct, I did use the ns switch combined with exporting it to a logfile. That's when I realized something was wrong with the scanner.  

Hope this helps!

Tim

I forgot some Junctions that you will probably want to add to the tail end of that previous list:

"C:\Documents and Settings" "C:\Users\All Users" "C:\Users\Default User\"

These addtions have been quite effective for our organization when using the tool, hopefully they'll help all of you out as well!

Tim