Adding exclusions for unwanted programs by filename or by directory does not work. Although the VSE 8.x Product Guide tells users to specify the exact name of the file or program to exclude detection, you must also exclude the name of the process for exclusion to work correctly.
When installing some utilities used for legitimate reasons, such as remote administration tools, VSE may detect these as PUPs due to the way they may have be used in conjunction with malware. After a utility is installed and a detection occurs, it is written to two different logs depending on how the detection happened. Separate logs are created for the On-Access Scanner and the On-Demand Scanner:
- OnAccessScanlog.txt
-
Ondemandscanlog.txt
Default log location: c:\documents and settings\all users\application data\McAfee\virusscan
Example of a log entry for a PUP detection TightVNC:
3/6/2007 4:50:17 PM No Action Taken ??????????\\administrator C:\WINDOWS\Explorer.EXE C:\Program Files\TightVNC\vncviewer.exe RemAdm-TightVNC (Remote Admin Tool)
Analysis of the Log information
| vncviewer.exe |
Filename |
| RemAdm-TightVNC |
Detection name contained in the DAT |
| (Remote Admin Tool) |
Group this Unwanted Program is associated with in the DAT |
