Scanning Files In Remote Storage; Scanning Ntfs Streams; Scanning Protected Files - McAfee VCLCDE-AA-DA - VirusScan Command Line Scanner Standard Product Manual

®
VirusScan Command Line 5.20.0 Product Guide

Scanning files in remote storage

Scanning NTFS streams

Scanning protected files

Under some Microsoft Windows systems, files that are not in frequent use can be
stored in a remote storage system, such as the Hierarchical Storage Management
(HSM) system. However, when the files are scanned using the
files become in use again. To prevent this effect, you can include the
In combination, these options request the stored file for scanning, but the file
continues to reside in remote storage. The file is not transported back to local storage.
Some known methods of file infection add the virus body at the beginning or the end
of a host file. However, a stream virus exploits the NTFS multiple data streams feature
in Windows NT and more recent Windows operating systems. For example, a
Windows 95 or Windows 98 FAT file has only one data stream — the program code or
data itself. In NTFS, users can create any number of data streams within the file —
independent executable program modules, as well as various service streams such as
file access rights, encryption data, and processing time.
Unfortunately, some streams might contain viruses. The scanner can detect a stream
virus in one of two ways; you can specify the full stream name, or you can include
and specify either no stream name, or a part of a stream name using the
/STREAMS
wildcard characters and
? *
The following table shows the effect of different commands on a stream called
that contains a virus.
FILE:STREAM
Table 3-1 Scanning streams
Command
SCAN /ALL /STREAMS FILE
SCAN /ALL FILE:STREAM
SCAN /ALL /STREAMS FILE:STREAM
SCAN /ALL FILE:STR*
SCAN /ALL /STREAMS FILE:STR*
SCAN /ALL FILE
The scanner normally scans files such as other users' profiles and recycle bins. To
prevent this type of scanning in Windows NT or later systems, use /NOBKSEM.
.
Action
All streams were scanned.
The virus is detected.
The exact stream name was specified.
The virus is detected.
The exact stream name was specified.
The virus is detected.
An exact stream name was not specified.
The virus is not detected.
All streams beginning with "str" are
scanned.
The virus is detected.
No streams were named.
The virus is not detected.
18
Using the Command-Line Scanner
Scanning files in remote storage
option, those
/DOHSM
option.
/NORECALL
3