Location of AOFO shadow copies

[David_Tracy]

We are using the AOFO and McAfee.  This morning McAfee had a box open with a list of virus trapped in \device\shadow copy...

Shadow copy is turned off on this server, so it must mean the AOFO from BE.  Where are these files stored so that I can delete the virus from them?  In other words, where is \device\shadow copy...?

Thanks,

David.

[tom_garrity]

I have looked for the same thing.  Here are some thoughts.

First, right click the volume (e.g., C:) in Windows Explorer and go to Properties > shadow copy components.  It's got to be enabled.  Also, someone may have pointed it to a different volume.

Second, look at the following web site.

http://www.sbs-rocks.com/Windows%20Server%20Hacks%20Excerpt.htm

It is an exerpt from a O'Reilly book.  Search for "you might be wondering"

It says Shadow Copy is residing in the System Volume Information folder on the designated volume.  Read the whole article for more info.

The down side is I looked and still cannot find anything of the size the article suggests.

Good Luck!

[David_Tracy]

Thanks for the reply Tom, I had already looked in the Microsoft stuff and it said the same thing, the sysvol.  I found some numbered folders at the beginning of the sysvol folder, and about half way down found a date that corresponds to yesterday.  However, the size of the files does not fit with the files on that server, or the file names either.

As I had written, the shadow copy option is turned off on all servers.  This is something that is being done by BE-AOFO.

Regards,

David.