3 ms·

I have an exe in my digital archive (a meticulously organized ZFS pool) which Windows is absolutely convinced is a virus. Windows likes to randomly delete this

I have an exe in my digital archive (a meticulously organized ZFS pool) which Windows is absolutely convinced is a virus. Windows likes to randomly delete this file. While I do keep backups, and I do my best to confirm their validity, this doesn't mean I want Windows randomly deleting files. I do delete old backups eventually. So for safety, I have been storing this exe file in an encrypted zip archive, where the password is the name of the zip file itself. After reading this article, I've changed the password to a random series of letters. However, I'm storing the password in a text file next to the zip file. And I have to wonder--is Windows going to start reading my text files to look for the password? This is honestly screwing with my head a tiny bit! What if Microsoft starts using a large language model to find the password? How far must I go to ensure Windows leaves my files alone?

smashed 3y ago
Honest questions come to mind: How is windows accessing the zfs pool exactly? Afaik, there is no zfs support on windows? Since these are backups, shouldn't they be read only? A snapshot at least would ensure easy rollback. Also, windows defender is not the only thing that can alter your archives. Think malware and ransomware.. once again a fully read only unalterable storage should be preferable if you care about the data.
- Wowfunhappy 3y ago
  > How is windows accessing the zfs pool exactly? Over SMB. > Since these are backups, shouldn't they be read only? A snapshot at least would ensure easy rollback. My digital archive is not a backup. It is digital storage which I actively use every day, and which is itself backed up. Windows is not deleting the file from the backups, but I don't keep old backups forever.
  - smashed 3y ago
    So windows will delete files over an SMB share? That is borderline malware isn't it? wow... Thanks for sharing.
    - FractalParadigm 3y ago
      Yes, and very happily too. Defender seems to not really care where the files are, as long as there's readable data on a drive mounted somewhere accessible, it's all fair game.
      - anonomousename 3y ago
        Have you tried setting an excluded zone and include your whole SMB share in it
        hulitu 3y ago
        Did an exclude zone ever worked ? I remember having to turn off the antivirus because it will happilly ignore my exclude zone (10 years ago)
        Wowfunhappy 3y ago
        This is my experience as well, I don't know if I'm doing something wrong or not but exclusions never seem to work, at least when Windows is convinced it has found a severe threat. I have to completely disable Real Time Protection.
  - justinclift 3y ago
    The (ZFS) snapshot approach mentioned above might be useful? That would make sure the important files are still available (even over smb) by going to the hidden .zfs directory inside the zfs file system. I'd probably do something like create a new ZFS file system on your server just for these special files, move them into it, snapshot the file system to ensure they're preserved, then make the filesystem available over the network via a new SMB share. That's just a rough first idea. If you're changing those special files much, then some kind of automatic timed snapshot thing (maybe with expiry) would probably be useful too. aka cronjob
WeylandYutani 3y ago
You are aware that you can stop windows security from automatically deleting stuff? And if you use third party antivirus software windows security is switched off.

smashed 3y ago

Honest questions come to mind: How is windows accessing the zfs pool exactly? Afaik, there is no zfs support on windows? Since these are backups, shouldn't they be read only? A snapshot at least would ensure easy rollback. Also, windows defender is not the only thing that can alter your archives. Think malware and ransomware.. once again a fully read only unalterable storage should be preferable if you care about the data.

Wowfunhappy 3y ago
> How is windows accessing the zfs pool exactly? Over SMB. > Since these are backups, shouldn't they be read only? A snapshot at least would ensure easy rollback. My digital archive is not a backup. It is digital storage which I actively use every day, and which is itself backed up. Windows is not deleting the file from the backups, but I don't keep old backups forever.
- smashed 3y ago
  So windows will delete files over an SMB share? That is borderline malware isn't it? wow... Thanks for sharing.
  - FractalParadigm 3y ago
    Yes, and very happily too. Defender seems to not really care where the files are, as long as there's readable data on a drive mounted somewhere accessible, it's all fair game.
    - anonomousename 3y ago
      Have you tried setting an excluded zone and include your whole SMB share in it
      - hulitu 3y ago
        Did an exclude zone ever worked ? I remember having to turn off the antivirus because it will happilly ignore my exclude zone (10 years ago)
        Wowfunhappy 3y ago
        This is my experience as well, I don't know if I'm doing something wrong or not but exclusions never seem to work, at least when Windows is convinced it has found a severe threat. I have to completely disable Real Time Protection.
- justinclift 3y ago
  The (ZFS) snapshot approach mentioned above might be useful? That would make sure the important files are still available (even over smb) by going to the hidden .zfs directory inside the zfs file system. I'd probably do something like create a new ZFS file system on your server just for these special files, move them into it, snapshot the file system to ensure they're preserved, then make the filesystem available over the network via a new SMB share. That's just a rough first idea. If you're changing those special files much, then some kind of automatic timed snapshot thing (maybe with expiry) would probably be useful too. aka cronjob

WeylandYutani 3y ago

You are aware that you can stop windows security from automatically deleting stuff? And if you use third party antivirus software windows security is switched off.