Scan timed Out events

[njseadooer]

Hello, we've recently started using vse85i sp5 with EPO 4 and I am seeing a lot of the following events reported from my clients, can someone tell me why? I just think it throws off the reporting.

Thanks in advance!
Craig


File Path C:\Program Files\Common Files\McAfee\Engine\avvclean.dat
Event Category Malware
Event ID 1059
Threat Severity Alert
Threat Name
Threat Type virus
Action Taken None
Threat Handled false
Analyzer Detection Method OAS

Event Descriptions

Event Description Scan Timed Out

[tonyb99]

So the OAS scanning is timing out while scanning its own DAT files, what are your time out settings on OAS?

[njseadooer]

The timeout settings are 45 seconds, which should be the default. I did not change too many settings from default.

Also, here is a sample log from another pc, its not just the dat file.


3/15/2008 11:54:20 AM Statistics:
3/15/2008 11:54:20 AM Files scanned: 853
3/15/2008 11:54:20 AM Files detected: 0
3/15/2008 11:54:20 AM Files cleaned: 0
3/15/2008 11:54:20 AM Files deleted: 0
3/17/2008 5:48:25 AM Engine version = 5200.2160
3/17/2008 5:48:25 AM AntiVirus DAT version = 5252.0000
3/17/2008 5:48:25 AM Number of detection signatures in EXTRA.DAT = None
3/17/2008 5:48:25 AM Names of detection signatures in EXTRA.DAT = None

3/17/2008 2:48:28 PM Statistics:
3/17/2008 2:48:28 PM Files scanned: 32599
3/17/2008 2:48:28 PM Files detected: 0
3/17/2008 2:48:28 PM Files cleaned: 0
3/17/2008 2:48:28 PM Files deleted: 0
3/18/2008 6:09:35 AM Engine version = 5200.2160
3/18/2008 6:09:35 AM AntiVirus DAT version = 5252.0000
3/18/2008 6:09:35 AM Number of detection signatures in EXTRA.DAT = None
3/18/2008 6:09:35 AM Names of detection signatures in EXTRA.DAT = None
3/18/2008 6:21:39 AM Engine version = 5200.2160
3/18/2008 6:21:39 AM AntiVirus DAT version = 5253.0000
3/18/2008 6:21:39 AM Number of detection signatures in EXTRA.DAT = None
3/18/2008 6:21:39 AM Names of detection signatures in EXTRA.DAT = None
3/18/2008 6:21:39 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Program Files\Common Files\McAfee\Engine\avvnames.dat
3/18/2008 6:22:04 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Program Files\Common Files\McAfee\Engine\avvclean.dat
3/18/2008 6:22:05 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\Agent_FMSLB.xml
3/18/2008 6:22:05 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Program Files\Common Files\McAfee\Engine\avvscan.dat

3/18/2008 11:31:26 AM Statistics:
3/18/2008 11:31:26 AM Files scanned: 8260
3/18/2008 11:31:26 AM Files detected: 0
3/18/2008 11:31:26 AM Files cleaned: 0
3/18/2008 11:31:26 AM Files deleted: 0
3/19/2008 10:39:48 AM Engine version = 5200.2160
3/19/2008 10:39:48 AM AntiVirus DAT version = 5253.0000
3/19/2008 10:39:48 AM Number of detection signatures in EXTRA.DAT = None
3/19/2008 10:39:48 AM Names of detection signatures in EXTRA.DAT = None
3/19/20083/19/2008 10:49:53 AM Engine version = 5200.2160
3/19/2008 10:49:54 AM AntiVirus DAT version = 5254.0000
3/19/2008 10:49:54 AM Number of detection signatures in EXTRA.DAT = None
3/19/2008 10:49:54 AM Names of detection signatures in EXTRA.DAT = None
10:49:53 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Program Files\Common Files\McAfee\Engine\avvnames.dat
3/19/2008 10:49:59 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Program Files\Common Files\McAfee\Engine\avvscan.dat
3/19/2008 10:49:59 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Current\SPAMSAFE1000\SK_det.mcs
3/19/2008 10:49:59 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\Agent_FMSLB.xml

Thanks,
Craig

[tonyb99]

Your scan is timing out on files that would be in use when the VSE was updating, the logs tend to indicate that this is an on demand scan??
You could move your update schedule outside of the scan schedule.

What patch level of VSE are you using? (patch 0 wasnt much cop at letting update files go when finished with them)

[njseadooer]

We are at Patch 5, and it looks like the Alerts are being reported from the On Aceess Scanner. So I really can't move schedules around.

I would think that more people would see these alerts here, i don't want to feel like the only one! hah

[overlook]

same problem for us and no solution found ! VSE 8.5 Patch5. We had the same error with patch4.

Any idea ? Thanks :confused:

[badaz06]

Within VSE you do have the ability to exclude specific files or directories from scanning (for example, overly large files that you feel are safe). Files that timeout on scan are reported as infected as a precaution, since technically the scan can't verify that they aren't.

[Magnolia00]

So has anyone found a solution for this? We just started having the same issues after upgrading to McAfee Antivirus 8.5. Our Malware Detection History is up to 30,000 events and climbing. All help is greatly appreciated.

[tonyb99]

I dont let EPO report on scan timeouts, you just turn event off from the central reporting, still gets logged locally of course but thats usefull sometimes.

EPO 4.0 - configration/server setting/event filtering/edit
EPO 3.6 - events option at bottom of reporting threads

[Magnolia00]

Thanks for that info. I will give that a try.