The addition of exclusions for unwanted programs by file name or by directory does not work. Although the VSE 8.x Product Guide tells you to specify the exact name of the file or program to exclude detection, you must also exclude the name of the process for exclusion to work correctly.
When you install some utilities used for legitimate reasons, such as remote administration tools, VSE might detect the utilities as PUPs due to the way they might have been used with malware. After a utility is installed and a detection occurs, it is written to two different logs depending on how the detection happened. Separate logs are created for the on-access scanner and the on-demand scanner:
- OnAccessScanlog.txt
-
Ondemandscanlog.txt
Default log location:
c:\documents and settings\all users\application data\McAfee\virusscan
Example of a log entry for a potentially unwanted program detection
TightVNC:
3/6/2007 4:50:17 PM No Action Taken ??????????\\administrator C:\WINDOWS\Explorer.EXE C:\Program Files\TightVNC\vncviewer.exe RemAdm-TightVNC (Remote Admin Tool)
Analysis of the Log information
| vncviewer.exe |
File name |
| RemAdm-TightVNC |
Detection name contained in the DAT |
| (Remote Admin Tool) |
Group this Unwanted Program is associated with in the DAT |
