DAT file and update process

[mmialhe]

Hello,

does anyone know what is the difference between these 3 DAT files ?

avvclean.dat

avvnames.dat

avvscan.dat

additional question is about the process of a the signature update ; from what I know VSE downloads the zip with the DAT and the engine decompress it but I wonder if there is something else happening... some users have told me their machines is stuck during the signature update (around 1 minute)

Thanks !

-M

[metalhead · Accepted solution]

AFAIK:

avvclean.dat -> cleaning instructions for malware

avvnames.dat -> names of signatures/malware

avvscan.dat -> signatures for malware detections

All three are needed and combined represent the actual DAT.

Additional to the full DAT there are 30 incremental update files (.gem).

If the signature is within the last 30 updates VSE update incrementally rather than downloading the full DAT.

If something is "stuck" on the client I would first check Windows taskmanager which process consumes high CPU ...

[mmialhe]

thanks for the answer !

I'll monitor this but from what I remember it was mcshield

is there any particular policy to set up (like prevent scanning the DAT file by the on access protection)?

cheers

[sameer172006]

Hi,

You can just add it to the Exclusions under the Access Protection, The On Access Scanner and if  need be even in on demand scans ..

Cheers

Sameer

[metalhead]

With the default setting the On Access Scanner (McShield.exe) scans the new DAT files when downloaded.

Best practise imho would be to put the mcafee processes "frameworkservice.exe" and "mcscript_inuse.exe" in a "Low-Risk" policy and add the appropriate exclusions and scan settings there.

Also patching could help - for further information check this link:

https://kc.mcafee.com/corporate/index?page=content&id=KB68965