Norton doesn't (or can't) scan "System volume information...

External Since: Mar 23, 2004 Posts: 6

Connected my win-98 drive to an XP-pro development system to scan the
win-98 drive for trojans/virii (The Cleaner, and NAV from NSW-2002 -
both updated to current def's).

Some viral files were found (harmless- attachements saved from spam
e-mails for manual scanning).

I guess it's XP's habbit of creating \System volume information\ on
every drive connected to it. During a scan by the cleaner it found
this:

D:\System Volume
Information\_restore{EDD79313-3427-47E1-8259-F3CC96419F7F}\Rp36\A0002906.scr

The SCR is MyDoom.A (saved from an e-mail attachment - never
executed).

Basically,

1) how did it end up in that directory, and

2) Why does NAV refuse to scan any subdirectories / files in that
folder, and will only scan that (that particular file) when I drag
it's nose down to the file itself?

3) The Cleaner apparently has no problem scanning all files in that
path (when pointed to the top-level directory) and, funny enough, NAV
intercepts the file when The Cleaner tries to access it.

So why does NAV fear to tread into the \System volume information\
directory tree? Is Rp36 a "restore point" ? Just like the recycler,
seens the \sys vol info\ folder would be a good place for virii and
trojans to hang out (and a very important place for NAV to be able to
scan). ???

External Since: Jul 04, 2003 Posts: 1562

Some Guy wrote:

> Connected my win-98 drive to an XP-pro development system to scan the
> win-98 drive for trojans/virii (The Cleaner, and NAV from NSW-2002 -
> both updated to current def's).
>
> Some viral files were found (harmless- attachements saved from spam
> e-mails for manual scanning).
>
> I guess it's XP's habbit of creating \System volume information\ on
> every drive connected to it. During a scan by the cleaner it found
> this:
>
> D:\System Volume
> Information\_restore{EDD79313-3427-47E1-8259-F3CC96419F7F}\Rp36\A0002906.scr
>
> The SCR is MyDoom.A (saved from an e-mail attachment - never
> executed).
>
> Basically,
>
> 1) how did it end up in that directory, and

microsoft magic... seriously, i have no better explanation for the
internal working of how things are chosen for backing up in system
restore than that...

> 2) Why does NAV refuse to scan any subdirectories / files in that
> folder, and will only scan that (that particular file) when I drag
> it's nose down to the file itself?

normally that folder is not accessible... generally speaking one finds
that folder on an ntfs partition (we are talking XP here, after all)
with the permissions set in such a way that only the local system
account can even read it...

> 3) The Cleaner apparently has no problem scanning all files in that
> path (when pointed to the top-level directory) and, funny enough, NAV
> intercepts the file when The Cleaner tries to access it.

of course, it intercepts it in a memory buffer, which is exactly how
most detections of system restore contents goes down...

> So why does NAV fear to tread into the \System volume information\
> directory tree?

because making changes there could really screw things up...

> Is Rp36 a "restore point" ?

yes...

> Just like the recycler,
> seens the \sys vol info\ folder would be a good place for virii and
> trojans to hang out (and a very important place for NAV to be able to
> scan). ???

unfortunately the risks outweigh the rewards... the consequences of
trying to restore from a restore point that's been corrupted by an
anti-virus (virus 'disinfection' does have a non-negligible chance of
corrupting the host) could be very bad...

--
"we're the first ones to starve, we're the first ones to die
the first ones in line for that pie in the sky
and we're always the last when the cream is shared out
for the worker is working when the fat cat's about"