VirusScan Enterprise 8.x queries in ePolicy Orchestrator show false positives on the network as malware

技術的な記事 ID: KB53317
最終更新: 5/21/2020

環境

McAfee VirusScan Enterprise (VSE) 8.8

問題

ePolicy Orchestrator (ePO) reports many false positives for files in McAfee related directories for network clients.

ePO reports show multiple Malware (Type Virus) entries similar to the following:

Event Category	Type	Detecting Product	Detecting Version	DAT Version	Engine Version	File Path
Malware	Virus	VirusScan Enterprise	8.8	7279.0009	7200.2160	C:\Program Files\Common Files\McAfee\Engine\avvnames.dat
Malware	Virus	VirusScan Enterprise	8.8	7279.0009	7200.2160	C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\UpdateHistory.ini
Malware	Virus	VirusScan Enterprise	8.8	7279.0009	7200.2160	C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Current\SUPERDAT1000\SuperDAT\0000\PkgCatalog.z

Files on which the scanner times out are reported as Virus and ePO reports them as:

Event category: Malware

問題

On the client, the VSE OnAccessScanLog.txt file frequently reports messaging similar to the following:

Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common
Framework\McScript_InUse.exe C:\Program Files\Common Files\McAfee\Engine\avvnames.dat
Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common
Framework\McScript_InUse.exe C:\Program Files\Common Files\McAfee\Engine\avvclean.dat

On the client, the Windows Application Event log frequently reports messaging similar to the following:

Type: INFORMATION
Source: McLogEvent
Event: 257
User: SYSTEM
Description: The scan of C:\Program Files\Common Files\McAfee\Engine\avvnames.dat has taken too long to complete and is being canceled. Scan engine version used is 7200.2160 DAT version 7263.0000.

Type: INFORMATION
Source: McLogEvent
Event: 257
User: SYSTEM
Description: The scan of C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\UpdateHistory.ini has taken too long to complete and is being canceled. Scan engine version used is 7200.2160 DAT version 7263.0000.

原因

The malware detections are actually scan time-outs.

解決策

This behavior is expected because this event category is assigned for instances where there is a scan time-out. These events are uploaded and reported to the ePO server. Make sure that you periodically review these events.

To submit a new product idea, go to: https://community.mcafee.com/t5/Enterprise-Product-Ideas/idb-p/business-ideas.

The Ideas forum is accessible only to McAfee business and enterprise customers. Click Sign In and enter your McAfee ServicePortal (https://support.mcafee.com) User ID and password. If you do not yet have a McAfee ServicePortal or McAfee Community account, click Register to register for a new account on either website.

For more information about product ideas, see KB60021 - How to submit a Product Idea.

NOTE: The Ideas forum replaces the previous Product Enhancement Request system.

回避策

You can filter the scan time-out events that are tagged as malware from the report at the ePO console. This action allows the generated reports to display only virus detections.

IMPORTANT: McAfee recommends that you do not add exclusions at the workstations to avoid the scan time-outs being reported.

To stop all time-outs from being included:

Log on to the ePO console.
To open up a remote console through Internet Explorer, type one of the following URLs into the browser and press Enter:

https://<servername>:8443
https://<ipaddress_of_server>:8443
Click Reporting, Queries.
In the left pane, select the query to modify.
- ePO: Malware Detection History
- VSE: Top 10 detected Threats
In the right pane, click Edit.
Click the Filter tab.
On the left panel, click EventID to be added, scroll down to the end of the page.
In the first drop-down list, change Equals to does not equal.
In the second drop-down list, type 1059.
Click Run.
Click Save, and then click Save again.

For a complete list of Event IDs for VSE, see KB52417.

影響を受ける製品

Known Issue/Product Defect
VirusScan Enterprise 8.8

言語:

この記事は、次の言語で表示可能です:

English United States
Japanese

技術用語集

用語集にある用語をハイライトする

当社の技術用語集を参照してください。

Knowledge Center

VirusScan Enterprise 8.x queries in ePolicy Orchestrator show false positives on the network as malware

環境

問題

問題

原因

解決策

回避策

影響を受ける製品

言語:

技術用語集

Title

Title

Knowledge Center

VirusScan Enterprise 8.x queries in ePolicy Orchestrator show false positives on the network as malware

環境

問題

問題

原因

解決策

回避策

影響を受ける製品

言語:

技術用語集

地域を選択してください

Title

Title