nComputing and Sophos

[SimonWindisch]

Hi there,

 

We have purchased 6 nComputing x550 workstations and we have run against an issue where Sophos seemingly causes the host computer to hang. The host is running Windows XP and the Central servers are running Windows 2003.

 

Our vendor offered us the following advice

For Sophos adding the C:\Windows\CSC\ folder to the Active Scanning exceptions list can resolve the issue. The CSC folder is for offline caching of files and folders when that feature is enabled on a network drive. The issue described above can actually be caused by the active scanning of the CSC folder even when offline file caching is turned off. It may also be necessary to explicitly provide exceptions for any files inside the folder, which can be done with wildcards using Sophos’ wildcard syntax. The usable wildcards in Sophos are the ? and * symbols, where ? is used for filenames and * is used for extensions. A known solution is also to add the exclusion “c:\windows\csc\????????????????????????????.*” to the Sophos policy.

 

Sometimes adding the C:\Windows\CSC\ folder or files inside it to the Active Scanning exceptions list will not fully resolve the stability issue. In these cases, a user may need to add the drive letters of any mapped network drives to the exclusion list as well, so that Sophos does not attempt to scan the mapped network drives for viruses. This should not cause a security problem as presumably the fileserver that is hosting the network drives will have its own antivirus solution, which will continue to scan the drives on its own.

 

Any thoughts or experiences on this? Is it wise to tell Sophos not to scan a directory?

 

Thanks - Simon

[User3204]

First off: Don't scan mapped drives, this is why you install a virus checker on the file server, and it just causes slowness, as every single workstation tries to scan all the files you have shared.

 

I would be wary of completely not sharing this folder, as I'm not sure what is in there. What I will do is only scan on write or on read, but not both. For example we don't scan the files where the mailserver stores its webmail.exe and config files when they are being read, but if any files are written to there, then yes (the files should only change when we do an upgrade).

 

I don't use Sophos, so I don;t know how easy it would be to scan on write but not read.