We are having an issue where a program is not running and it turned out to be caused by McAfee VirusScan. Looking at the Access Protection Log, we saw that it was "Anti-virus Maximum Protection" and the rule was "Prevent svchost executing non-Windows executables." Disabiling Access Protection allows the program to run, but instead of leaving this off, we are trying to use the "processes to exclude" field. However, when we enter the exe name, it is still logged as being blocked by this rule. Out of curiousity, we entered *.exe and that allowed it to run, however, this would obviously exclude all exe files, which we don't want to do. Any suggestions or workarounds to this issue? The environment is VirusScan 8.8, ePO 5.1, MA 4.8. Thanks.
I would not exclude the svchost.exe in any case as you will open a big security hole as many of the virus uses this process to infect the machines. I would talk to the application developer to see if something can be done in the installer to change the behaviour and the process to be used (svchost.exe)