Jump to content

F-secure and junction points


Recommended Posts

Guest Mervita
Posted

Hi!

 

I've got a problem with F-secure Client security and Vista junction

points named application data. The virus scan gets stuck in these

recursive folder structures or the scan takes ~6h.

 

The folder is: \\?\C:\Users\All Users\Application Data\ where

Application data appears 14 times.

 

I've understood that this might be a problem with a particular

anti-virus software but at F-secure they did not know about this

problem. So, has anyone stumbled on this problem with F-sec or another

anti-virus prog. and what has been your solution?

 

Furthermore, what is a correct number of recursive folders in this

path? I'm thinking that there might be a program in my computer creating

too many of these loops.

 

Any help is greatly appreciated!

 

WR, Mervi

 

 

--

Mervita

  • Replies 3
  • Created
  • Last Reply
Guest MowGreen [MVP]
Posted

Mervita,

 

If there are 14 different Application Data subfolders at

C:\Users\All Users then there may be some sort of file corruption going

on. Configure F-secure to not scan the folder since nothing can be

'stored' there anyway and see if that restores the one subfolder that

should be there

 

 

MowGreen [MVP 2003-2009]

===============

-343- FDNY

Never Forgotten

===============

 

 

Mervita wrote:

<span style="color:blue">

> Hi!

>

> I've got a problem with F-secure Client security and Vista junction

> points named application data. The virus scan gets stuck in these

> recursive folder structures or the scan takes ~6h.

>

> The folder is: \?C:UsersAll UsersApplication Data where

> Application data appears 14 times.

>

> I've understood that this might be a problem with a particular

> anti-virus software but at F-secure they did not know about this

> problem. So, has anyone stumbled on this problem with F-sec or another

> anti-virus prog. and what has been your solution?

>

> Furthermore, what is a correct number of recursive folders in this

> path? I'm thinking that there might be a program in my computer creating

> too many of these loops.

>

> Any help is greatly appreciated!

>

> WR, Mervi

>

> </span>

Guest Sam Hobbs
Posted

I am not sure I understand what you mean by "recursive folders" but the

maximum size of a "path" is 260 (with some exceptions). In this context, a

path includes the filename. The following might be too technical for you but

it does provide all the details.

 

File Names, Paths, and Namespaces

http://msdn.microsoft.com/en-us/library/aa...mum_path_length

 

 

"Mervita" <guest@unknown-email.com> wrote in message

news:6de2e55d8ba486f0f9f9730840b30532@nntp-gateway.com...<span style="color:blue">

>

> Furthermore, what is a correct number of recursive folders in this

> path? I'm thinking that there might be a program in my computer creating

> too many of these loops.</span>

Guest Adrian Accinelli
Posted

"Mervita" <guest@unknown-email.com> wrote in message

news:6de2e55d8ba486f0f9f9730840b30532@nntp-gateway.com...<span style="color:blue">

> Hi!

> I've got a problem with F-secure Client security and Vista junction

> points named application data. The virus scan gets stuck in these

> recursive folder structures or the scan takes ~6h.

> The folder is: \?C:UsersAll UsersApplication Data where

> Application data appears 14 times.

> I've understood that this might be a problem with a particular

> anti-virus software but at F-secure they did not know about this

> problem. So, has anyone stumbled on this problem with F-sec or another

> anti-virus prog. and what has been your solution?

> Furthermore, what is a correct number of recursive folders in this

> path? I'm thinking that there might be a program in my computer creating

> too many of these loops.

> Any help is greatly appreciated!

> WR, Mervi</span>

 

 

F-secure has a bug.

 

If you look at C:\ProgramData it contains a junction called Application Data

which points to C:\ProgramData itself. [see it: run cmd.exe -> dir

C:\Users /AL]. By itself this forms a loop. Since all roads to the "All

Users" folder actually lead to C:\ProgramData (e.g. taking C:\Documents and

Settings\All Users or C:\Users\All Users routes), applications that

enumerate through this space will encounter the loop.

 

In this case F-secure enumerates C:\Users\All Users and finds Application

Data which it treats as a regular folder so recurses inside and continues

enumerating. This brings it back to where it just was and eventually sees

Application Data again and recurses inside...

 

Vista adds security to deny everyone the ability to list folder/read data

from most of the standard junctions - including Application Data. F-secure

is not honouring them.

 

So there's two ways that F-secure could be fixed to prevent this problem -

ignore junctions themselves or honour the security permissions on the

junction itself.

 

Sincerely,

Adrian Accinelli

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


×
×
  • Create New...