it seems the quick scan on context menu (explorer scan)
isn’t working properly with directories containing sub-directory which is junction/symbolic link to another directory with sub-directories and files etc.
i discovered this by pure luck as i got issue with false positive yet the scan of whole root directory returns nothing
i got down N levels to last directory with the binary, repeat the scan, detection will happen
this feels like quite serious flaw
note: “Follow links during scan” is checked (enabled)
go into junction folder and Explorer menu (content menu) scan
scanned folders : 1
scanned files : 0
repeat the scan on all subfolders below it, result:
scanned folders: 16502
scanned files: 39440
so I asked myself Question is if this problem is in all other scans too …
Scan NTFS symlink/junction folder via “Scan for Viruses > Select Folders to Scan”
scanned folders : 1
scanned files : 0
then repeat the scan on all subfolders below it, result:
I believe it’s connected to the option “Speed up scanning by reading files in the order they are stored on disk” on the Performance page.
I’ll see if we can do anything about it, but it’s possible that these options are simply incompatible, i.e. that enabling one will have to disable the other.
I don’t think scans like Full System Scan or Quick Scan are affected because they scan all hard drives (or the whole system drive), so the links don’t really matter (unless the link goes from the system drive elsewhere in case of the Quick Scan, but then it’s questionable anyway whether the “remote” content should be scanned as part of the quick/system drive scan).
hmm and Smart Scan seems like has same option too …
also the setting is present for all the other Full, Quick, Custom except bootscan
so hard to tell if they also negatively affected ;(
p.s. note that those Junctions / Symbolic Links are usually leading to another drive which sort of invalidates the ‘order of storage on drive’ completely
Nope, Smart Scan doesn’t enumerate the folder structure at all, it basically scans just autorun entries end loaded modules.
And that’s correct (if you mean the setting about the ordered scanning), that’s where it has the biggest effect. Why Quick Scan has the option to follow links enabled, I’m not sure, it should be disabled in my opinion.
I think that basically the only scan where it may be somehow confusing is the Explorer Extension, and possibly the “Select folder to scan” one.
Now I think the whole thing is questionable… you select the C: drive to be scanned, so should we actually scan the C: drive, or also something else on completely different volumes? Some would choose the former, some the later. Sure, when the option is there, it should work… but I can also imagine a “solution” could be to remove the option and not follow links at all (one problem with following links is that they can end up in an infinite loop). I’m not saying I would like that solution… I’ll see what I can do, but no promises.
I certainly don’t agree with the first part
99.9% of the users only have the default system links - which lead to the same (system) drive.
Only very few users would have created their own links, possibly leading elsewhere.
as I already wrote it 100% affected both the Explorer and Custom Folder scan
had no time to test anything else …
but by same logic I would not be shocked if the bug affects everything … (bugs are sneaky)
I’m pretty sure there is more than 0.1% users utilizing custom Junctions / Symbolic Links especially since SSD and Games became standard on PC platform
crazy software developers included too
it might be obscure stuff in XP era (Junctions only, non-standard) but it became standard since Vista …
plus I just realized one thing “File Access” setting should be automatically ignored on SSD drives and similar
