Re: Norton Antivirus
Re: Norton Antivirus
- Subject: Re: Norton Antivirus
- From: Jeremy Pereira <email@hidden>
- Date: Sat, 20 May 2006 13:10:08 +0100
On May 19, 2006, at 06:18, Michael Smith wrote:
The reason I am asking is that I'm trying to understand what
effect it might have on my VFS kext.
Without knowing what your VFS kext does, specifically, it's hard to
offer you much extra help. Typically you can expect an AV product
to watch file operations that either affect the contents of files,
or depend on their contents (open, execute, etc.). These
intercepts will occur between the lookup operation and the
corresponding access operation, and may result in secondary
operations against the file.
I was just trying to eliminate a possible cause of a bug. As it
turned out the Norton installation on the machine in question was
broken and not scanning files anyway.
e.g. for an execute operation, you might expect to see a file
looked up, then opened, read, closed, then executed. If you aren't
keeping state dependent on VNOP call ordering, you should never
know that something is snooping.
= Mike
I probably don't need to worry then.
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden