Opening Attached .pdf in Outlook takes 10 secounds after Upgrading to ENS

[TSodoge]

Hello Everyone,

Since our Migration from VSE to ENS, it takes around 10 seconds to open a .pdf - Attachment in Outlook 2016. Once you close the File and open it again, it takes less than 1 second. If you try it again a few hours later, it takes 10 seconds again to open.

We are using Adobe Acrobat Reader DC to view pdf-Files. The Error cant be reproduced when using MS Edge or other Programs.

Excluding the Folder of the Acrobat Reader does not help and is not the way that I want to fix that problem.

Has anyone else had this Problem before and got a Solution ? Can someone explain to me why it takes so long to open the File in first place ?

The Problem only occours with pdf-Files and Adobe Reader. Unfortunately Adobe Support cant help me..

Best Regards

[Daveb3d]

It is important to be careful here as PDFs are a significant threat source.

To start, is your OAS settings configured to "Let McAfee Decide"? 

Dave

[TSodoge]

Hi Dave,

yes, OAS is set to "Let McAfee Decide". It is scanning all Files.

[Daveb3d]

Hmm..

Make sure you aren't going by a first run of the apps, as it will need to cache the app. The first will always be slower. Also, if it is just a slow system, that could be impactful.

You might ensure you don't have "Detect suspicious email attachments" enabled, and do select "Disable read/write scan of the Shadow copy volumes for SYSTEM processes". Ensure your basic OS exclusions are in place, and I do recommend using low-risk processes to optimize things (though you wouldn't want to make Outlook or Adobe Reader low risk). 

Bear in mind that ENS is much more robust than VSE in terms of threat detection, and while it is more optimized, I would expect certain things to run slower because they deserve more analysis.  

You might try using the McAfee Profiler tool to see what is loading, and also check Resource Monitor by looking at Disk access while it runs. 

I ran a few tests and it definitely isn't that slow for me, so it is certainly worth pursuing this, and I'm running a mountain of Expert Rules on top of everything else + EDR, DLP, and other stuff.  

Dave

Dave

[TSodoge]

I've disabled "Detect suspicious email attachments" and enabled "Disable read/write scan of the Shadow copy volumes for SYSTEM processes" for OAS in my test enviroment.

I'll let you know if it helps.

[AdithyanT]

Hi @TSodoge,

Thank you for your post.

I would like to add that performing component isolation would help us identify which feature component is causing the issue and  will help us filter down further.

The below KBA may help you with the same within Threat Prevention component:

https://kc.mcafee.com/corporate/index?page=content&id=KB89757

Sincerely hope this helps.

[TSodoge]

Hello everyone,

I was able to narrow it down to the Antimalware Scan Interface of the OAS. The performance problems even occour in Observe mode.

Acrobat JavaScript is already disabled. I'm also not aware of any other Scripts running in the background.

Guess I'll have to check what Outlook is doing when starting the Adobe Reader.

Any other suggestion ?

[AdithyanT]

Hi @TSodoge,

May I know if below Doc helps?

https://docs.mcafee.com/bundle/endpoint-security-10.7.x-common-product-guide-windows/page/GUID-FA327...

Since we don't see any detections, you can use the "File Based exclusion" option. Please let us know if that helps.

[Daveb3d]

Maybe open a ticket on the AMSI issue? If there is a bug would be good to see it cleared up.

Dave