Exclusions variable %ProgramFiles% defaults to %ProgramFiles(x86)%
技術的な記事 ID:
KB52744
最終更新: 4/29/2020
環境
McAfee VirusScan Enterprise (VSE) 8.x
Microsoft 64-bit supported operating systems:
Windows Vista
Windows XP
Windows 2003
問題
On the 64-bit operating systems listed above:
The VirusScan Enterprise 8.x exclusion variable %ProgramFiles% defaults to %ProgramFiles(x86)%
The variable %ProgramFiles% is replaced with %ProgramFiles(x86)% when exclusions are applied via an ePolicy Orchestrator policy using system variables.
The exclusions that are expected to be for directories with \Program Files\ are changed to \Program Files(x86)\ can lead to problems when the server runs applications like 64-bit Exchange. This change causes the policy to point to an incorrect directory.
NOTE: When 32-bit applications write to the Windows registry, 64-bit versions of Windows automatically change the %ProgramFiles% system variable to %ProgramFiles(x86)%.
原因
The issue is of Microsoft Windows. For details, see the knowledgebase article in the Microsoft Documentation.
解決策
Testing shows that this issue can be avoided with the following two exclusions. The issue does not occur if you use UPPERCASE characters in the variable.
Exclusion set
Effective On-Access Scan exclusion on a Windows 2003 (64-bit) client:
%ProgramFiles%\MyProgs
%ProgramFiles(x86)%\MyProgs
%PROGRAMFILES%\MyPrograms
%PROGRAMFILES%\MyPrograms
回避策
Redefine exclusions to use other matching methods such as wildcards instead of system variables.
関連情報
Related articles about exclusions:
KB50383 - Potentially Unwanted Programs continue to be detected when excluded by name only
KB54812 - How to use wildcards when creating exclusions in VirusScan Enterprise
KB79589 - How to make On Access Scanner (real-time) exclusions more secure
