cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

MOVE Multiplatform 3.6.1 Offload Scan Server scanfiles directory - Can you delete files

Jump to solution
We had our McAfee MOVE 3.6.1 offload servers in place for 2 years(They will be upgrade soon..)and the folder \McAfee\MOVE AV Server\Scanfiles is taking up a lot of space on disk. What is it? and can the folders and files within be deleted safely?
2 Solutions

Accepted Solutions
McAfee Employee amit_naidu
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: MOVE Multiplatform 3.6.1 Offload Scan Server scanfiles directory - Can you delete files

Jump to solution

Hello @cybercop ,

Thank you for your query!

Files less than the “MaxFileSize” setting are copied to the MOVE-AV Server over TCP, stored in a temporary location inside the install directory (e.g. <install directory>\scanfiles or <RAM drive>\McAfee\MOVE AV Server\scanfiles). The checksum of these files is computed. Using an Engine instance within the MOVE-AV server the locally copied file is scanned. If the scan result says that the file is clean, the checksum is cached on the offload server, and the client also caches the scan result.

Yes the Folder and files can be deleted safely

Was my reply helpful?

If you find this post useful, please give it a Kudos!
Also, please don't forget to select "Accept as a solution" if this reply resolves your query!

Thank You,

Amit N
McAfee Technical Support

View solution in original post

McAfee Employee patrakshar
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: MOVE Multiplatform 3.6.1 Offload Scan Server scanfiles directory - Can you delete files

Jump to solution

\McAfee\MOVE AV Server\Scanfiles location stores the files in temporary basis for scanning. once the scanning is completed it gets deleted. 

Firstly it not supposed to be there. This has been seen before with 3.6 version which was fixed in 3.6.0.385. It can only happen when the file has reached from Client to SVM for scanning but before the complete offset reaches client to SVM connection has been closed down. As a result SVM did not get the complete file from client to scan it and could not delete it as well later.

It can also happen if there is trust module between VSE and MOVE has been broken. In this case you might also see that within VSE On access Scanner log MVSERVER.EXE process is getting timed out. This can be resolved by adding MVSERVER.EXE as low-risk process within the VSE and making sure that Scan on Read/Write within Low-Risk process has been un-checked. When the trust between VSE and MOVE gets broken the scan calls received from the clients will not reach to MOVE but will reach VSE. VSE does not delete the file post scanning from that location which MOVE does. So you might be seeing those files there. You can share the VSE OAS log and we can verify if that is the situation you are hitting.

View solution in original post

2 Replies
McAfee Employee amit_naidu
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: MOVE Multiplatform 3.6.1 Offload Scan Server scanfiles directory - Can you delete files

Jump to solution

Hello @cybercop ,

Thank you for your query!

Files less than the “MaxFileSize” setting are copied to the MOVE-AV Server over TCP, stored in a temporary location inside the install directory (e.g. <install directory>\scanfiles or <RAM drive>\McAfee\MOVE AV Server\scanfiles). The checksum of these files is computed. Using an Engine instance within the MOVE-AV server the locally copied file is scanned. If the scan result says that the file is clean, the checksum is cached on the offload server, and the client also caches the scan result.

Yes the Folder and files can be deleted safely

Was my reply helpful?

If you find this post useful, please give it a Kudos!
Also, please don't forget to select "Accept as a solution" if this reply resolves your query!

Thank You,

Amit N
McAfee Technical Support

View solution in original post

McAfee Employee patrakshar
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: MOVE Multiplatform 3.6.1 Offload Scan Server scanfiles directory - Can you delete files

Jump to solution

\McAfee\MOVE AV Server\Scanfiles location stores the files in temporary basis for scanning. once the scanning is completed it gets deleted. 

Firstly it not supposed to be there. This has been seen before with 3.6 version which was fixed in 3.6.0.385. It can only happen when the file has reached from Client to SVM for scanning but before the complete offset reaches client to SVM connection has been closed down. As a result SVM did not get the complete file from client to scan it and could not delete it as well later.

It can also happen if there is trust module between VSE and MOVE has been broken. In this case you might also see that within VSE On access Scanner log MVSERVER.EXE process is getting timed out. This can be resolved by adding MVSERVER.EXE as low-risk process within the VSE and making sure that Scan on Read/Write within Low-Risk process has been un-checked. When the trust between VSE and MOVE gets broken the scan calls received from the clients will not reach to MOVE but will reach VSE. VSE does not delete the file post scanning from that location which MOVE does. So you might be seeing those files there. You can share the VSE OAS log and we can verify if that is the situation you are hitting.

View solution in original post

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community