Avira "Monitor Network Drives" causes Samba errors

Completed

Oliver

• September 18, 2020 18:48

Hi,

I am using Avira Antivirus Free, the latest and updated version.

The feature "Monitor network drives" (Real Time Scanner) is enabled by default, along with the equivalent option for the On Demand scan.

When I install Avira and browser a network Samba share which requires authentication, the Real Time Scanner kicks in and produces a huge amount of errors.

Windows side errors can be found in Event Viewer at SMBClient section and are:

Error: {Access Denied}

A process has requested access to an object, but has not been granted those access rights.

Path: \nas\data

Error code: 31010

 

Samba errors are:

create_connection_session_info: guest user (from session setup) not permitted to access this share (data)

create_connection_session_info failed: NT_STATUS_ACCESS_DENIED

 

I have verified with Wireshark and Samba verbose logs that when Avira is installed there are anonymous attempts to browse my shares, which should also be blocked on Windows 10 for security purposes.

When Avira is uninstalled or the above features are disabled, no issues at all!

I have replicated this behavior on Windows 10 Pro fresh installs edition 1903 and 2004, using two different Samba servers running Samba 4.9.5. Always been able to replicate this issue.

I am a technical user so if somebody needs more details, I'm willing to help.

Yes 0 No

• 

  pascha45

  • September 21, 2020 07:15

  Hello Oliver,

  Your contribution has been forwarded to the support team. From there you will receive further information after the review.

  If anything is still unclear, please let us know, we will be happy to help.

  Many greetings

  Yes 1 No

Post is closed for comments.