We are in a ePO managed environment. On all our systems, at noon, we schedule a McAfee Scan task which scans for just "Processes" and "Memory".
This is a daily scan which McAfee recommends in the VirusScan 8.8i best practices guide.
I have one high profile user, who is complaining that his system becomes unusable during this time. I had him send me the log file and I scan see that the scan on most days only takes about 2 or 3 minutes to run. There a few times each month where is shows 21 minutes or so.
Does anyone know if there is any settings or recommendations that I can do to help this user. Don't want to disable this task as it is important. The only option that I can see is to have the task set to run no longer than say 5 minutes. anyone have any ideas?
I had similar issues, in the end I settled for adding a max run time of 5 minutes to this task to avoid the issues with users with the more random systems.
Also I agree this is whats needed from the best practice guide to enable you to disable scanning of processes on enable, but so far in my 6+ months of this running it hasnt caught a single thing! and it runs completely on a large majority of systems.
Since I fully implemented the best pratice guide my detections are now primilary via OAS, it used to be my monthly scan that picked them all up.
hope this helps!
Thanks for the information. Like you, I have yet to have this scan detect any threats. In our environment, most threats are being found with the OAS. I have taken your suggestion and set the task to stop running after 5 minutes. The McAfee documentation states that it should take no longer than a couple of minutes. Don't understand why on some systems it can takes say 21 minutes. We are trying to avoid issues with people computers during the day.
Yes the same happened to some of my machines, and like you it was different everyday! It can vary so much about whats happening on the system and what they are doing, mine can finish in a minute, but our developers always gets closer to the 5 minute.
also I come up with some 'deals' with the worst affected users to get rid of the issue compeletly. i.e. run at 1pm when they are always at lunch etc...