| There's one method that will work though it's a shade strange.
IF the customer can get only certain disks to be scanned, have
him set up remote virtual disk over decnet locally, and have
it set to inhibit writing from the remote end. It'll lie to the
client and claim the write was OK but such a disk could be mounted
/nocache and the virus scanner could see the files and access
them,but there'd be nothing written to the original disk. A
similar trick could be used with a VD type virtual disk (or maybe
with lddriver...haven't looked at that) but this means telling
the virus scanner to look only at certain disks, namely these
bogus (and private mounted) versions.
The scanner would still be able to work, but the files would not
have dates altered.
Freeware cd V3 has the sources for the driver in question.
My understanding of these scanners is they look for PC viruses on
servers BTW...don't think a vms virus in the wild has ever been
seen, though a couple lab versions have been created.
|
| re: <<< Note 335.0 by CSC32::BSS::SAUL >>>
> ...touches every file and reads it...
It would be useful to define this phrase more precisely. Since neither of us
know the complete details of the scanner implementation, I will list some of
the possible actions and their side effects.
1. When the scanner performs a file access operation, it can obtain the
file's attributes. A "sophisticated" scanner would recognize that a
file is shelved and omit further processing.
I am not aware of any scanners which behave this way today.
2. When the scanner opens a file, the expiration date will be updated
when the file is closed, regardless of subsequent operations. This is
based upon the disk's volume retention values, and is what you have
reported.
3. When the scanner attempts to read file data, a file fault (unshelve)
will occur, and all shelved files on the disk will be unshelved as a
result (not good). It is possible to disable automatic unshelving by
the scanner using set process/NOAUTOUNSHELVE, however, this will return
an error to the scanner for each shelved file it encounters. This may
either stop the scan, or generate large log file volume (again,
not good).
4. If you use the modification (revision) date to select files for
shelving (as suggested in .1), the fact that the scan updates the
files' expiration dates (as in 2.) should not affect the files selected
for shelving. This assumes that files are opened read-only, otherwise
the modification dates will also be updated by the scan.
Even if you choose #4, you still have to deal with #3.
Hope this information helps,
/Paul
|