Knowledge Center

McAfee anti-virus products have an intentional cutoff time when the scan of a particular file must stop, and the scan timeout feature is intended to prevent a denial of service.

All McAfee Anti-Virus products work in a similar way:

1. A request for a file is intercepted by the On-Access Scanner.
2. The file is scanned.
3. The file is passed to the user or application that requested the file or, if the file is infected, the appropriate action is taken by the scanner and the user is informed of the infection.

• File complexity
• File size
• File location
• File type. File extensions such as .jar, .chm, .cab, and .zip are all archive files that typically use a very high compression. To scan these archives, each file must be extracted from the archive. This can use a large amount of memory depending on the type of data in the archive and how well it compresses.
• Processing power of the computer scanning the files (and amount of memory if the file must be uncompressed)
• Network speed (if the file has to be copied over a network to be scanned)

If a timeout mechanism is not used, you are denied access to the file until the scan is complete (this might be minutes or even hours, depending on the factors previously mentioned). For example, if the file is still being scanned after 30 seconds, the scanner will time out. The length of time before this timeout occurs varies by product and can usually be configured. For information on configuring scan timeout settings for your product, see the appropriate product guide.

If the scan of a particular file takes longer than allowed by the timeout value, the scan is stopped. An event is generated in the application event log to note that the scan timed out on the file after the defined scan timeout value. This information is also sent to Alert Manager and ePolicy Orchestrator if they are installed. An example of this error message would be as follows:

The scan of FILENAME has taken too long to complete and is being cancelled. Scan engine xxx and DAT version is xxxx