Thread Info
  • State Suggested Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 10 replies
  • Answers 1 answer
  • Subscribers 17 subscribers
  • Views 23159 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Strange Behaviour - right click scan

Martin Mcquillan

Hi, recently moved over to Sophos Cloud.

In the past any time I downloaded a file I would right click scan to be safe.

I have noticed since our change over my scanned files count is always 3 and a colleagues is always 5.

Is this normal?

Doesn't seem to matter if its an exe, archive or single pdf.

 

Thanks in advance



This thread was automatically locked due to age.
  • 0
     
    Please help me with the following information:
     
    1. OS on the client machine?
    2. On how many machines do you see this? 
     
    Please do share the screenshot of what you are talking about. 
     
    Haridoss S

    Haridoss Sreenivasan
    Technical Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • 0

    I have tried on two machines, both running Windows 10 pro.  Below is an example of a pdf and an installer.  Always the same even on a large archive.

  • 0 in reply to Martin Mcquillan

    Hilarious i just checked my own document and i have a 5 and a 6!

  • 0 in reply to Martin Mcquillan
    Hi Martin,
     
    Thank you for the screenshot. Does this happens when you scan the files from any folder location?
     
    Haridoss S

    Haridoss Sreenivasan
    Technical Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • 0 in reply to Haridoss Sreenivasan

    I have observed the same strange behavior.  On one client (Windows 8.1 64-bit) a single file shows as (3) scanned items and on another client (Windows 7 32-bit) it shows 2 scanned items.  Location does not seem to matter.

  • 0

    Hello Martin Mcquillan et al.,

    one item (note it says items, not files) is the MBR of the physical drive. On a Win7x64 I've constantly 2 additional items, can't say what the second one is (or the others when the count is even higher). It's definitely normal though.

    I would right click scan to be safe
     should already have scanned the file, and On-Access will do so if you're attempting to open it. Thus an additional right-click scan is not necessary. 

    Christian

  • 0 in reply to QC

    Hi Christian.  I suspect you are right that it is counting more than just the file (perhaps the folder as well?).  The part that concerns me is that two different OS's give different number of items when scanning the exact same file in the exact same path.  Maybe I am over-reacting, but I feel the scanning engine should be consistent across platforms for what it scans.

  • +1 in reply to K_M

    Hello KeithMurphy,

    two different OS's give different number of items when scanning the exact same file in the exact same path
    first of all you say different OS's, so the environment is not exactly the same. the exact same from a certain (abstract) POV - file system, file system implementation, logical device/volume, last but not least hardware can all be different. But anyway the question isn't whether the file is scanned in the same way, in principle it is (note that even if the contents are the same the metadata might be different).
    It's the "unknown additional items" which aren't dependent on the file system items being scanned (the excess doesn't change) - apparently they do depend on the system being scanned. But it's not that the engine is less thorough on some.  

    Christian

  • 0 in reply to QC

    I suppose you have a good point about the environment.  With Windows 7 being SMBv2.1 and Windows 8 being SMBv3.0, perhaps there are indeed some differences to account for the item counts.  I guess I will submit it as a feature request to get a more detailed scan report.  Thanks.

  • 0 in reply to K_M

    Under the hood, there is config in a right click scan for:

    Scan memory

    Scan registry

    these 2 items if scanned will add 2 to the count.

    Then there is one for each hard disk and then finally the file.  

    In the older UI you could toggle scan memory and scan registry in the advanced config settings of the right click scan as shown below:

Unfiltered HTML