ScriptScan causes significant performance hit/load delay on websites
技術的な記事 ID:
KB70013
最終更新: 3/12/2020
環境
McAfee VirusScan Enterprise (VSE) 8.x
For details of VSE 8.x supported environments, see KB51111.
問題
Webpages load slowly when you enable the VSE 8.x ScriptScan feature. Whitelisting the specific URLs does not significantly improve performance.
After you enable debug logging for ScriptScan, the index file includes records similar to the following:
NOTE: Debug logging instructions are provided by Technical Support.
C:\VS_Debug\SCR20D.tmp
800
d635b207
(519)
JavaScriptParseProcedureText
C:\VS_Debug\SCR20E.tmp
800
fabd2255
(597)
JavaScriptParseProcedureText
C:\VS_Debug\SCR20F.tmp
800
75c67ffe
(1022)
JavaScriptParseProcedureText
C:\VS_Debug\SCR210.tmp
800
b504413d
(317)
JavaScriptParseScriptText
C:\VS_Debug\SCR211.tmp
800
ac4dd2d3
(723)
JavaScriptParseScriptText
C:\Test\SCR84D3.tmp
800
e8ebb498
(152)
JavaScript9ParseProcedureText
C:\Test\SCR8541.tmp
8100
390bb264
(612)
JavaScript9ParseScriptText
The number of files created in DebugDumpDirectory might be hundreds or even thousands.
原因
VSE scans scripts when processes (usually Iexplore or Firefox) send them to the scripting host engine. The load delay occurs because of the way Internet Explorer is designed.
For example, Internet Explorer sends all scripts to the scripting host when a page is loaded. But, Firefox sends the scripts only when they have to be run. So, the loading time of the same page is faster for Firefox.
解決策
This behavior is expected for ScriptScan with Internet Explorer.
回避策
IMPORTANT:
Although it is possible to disable ScriptScan, McAfee recommends that you first create and test exclusions before you completely disable this feature. There is some security risk in disabling ScriptScan. The reason is because applications like Outlook and Internet Explorer can render and execute scripts before a file has been created on the local system. It is important to point out that the on-access scanner can stop the payload of attacks via this medium. But, ScriptScan has the added advantage of preventing an actual threat from executing in the first place.
You can be confident that even though ScriptScan might not be right for all environments, VSE 8.x provides superior protection against blended threats. It provides integrated Buffer Overflow protection for common desktop applications and services, Access Protection rules to block and contain common threat models, and true On-Access Scanning for malware. Malware includes Anti-Spyware. VSE also provides rapid-response regular-DAT updates backed by the power and performance of ePO.
But, McAfee recognizes that you might be in the difficult position of making the trade-off between enhanced protection and user performance. You can elevate your protection level back to a comparable level by installing a Secure Web Gateway appliance just behind your externally facing web servers. This solution provides the same protection as ScriptScan, but is directed only at the external web traffic, leaving the internal portal traffic unencumbered.
Unregister scriptsn.dll to disable ScriptScan:
Click Start, Run, type regsvr32.exe /u and the path to scriptsn.dll.
