cancel
Showing results for 
Search instead for 
Did you mean: 

Scan timed Out events

Hello, we've recently started using vse85i sp5 with EPO 4 and I am seeing a lot of the following events reported from my clients, can someone tell me why? I just think it throws off the reporting.

Thanks in advance!
Craig


File Path C:\Program Files\Common Files\McAfee\Engine\avvclean.dat
Event Category Malware
Event ID 1059
Threat Severity Alert
Threat Name
Threat Type virus
Action Taken None
Threat Handled false
Analyzer Detection Method OAS

Event Descriptions

Event Description Scan Timed Out
19 Replies
tonyb99
Level 13
Report Inappropriate Content
Message 2 of 20

RE: Scan timed Out events

So the OAS scanning is timing out while scanning its own DAT files, what are your time out settings on OAS?

RE: Scan timed Out events



The timeout settings are 45 seconds, which should be the default. I did not change too many settings from default.

Also, here is a sample log from another pc, its not just the dat file.


3/15/2008 11:54:20 AM Statistics:
3/15/2008 11:54:20 AM Files scanned: 853
3/15/2008 11:54:20 AM Files detected: 0
3/15/2008 11:54:20 AM Files cleaned: 0
3/15/2008 11:54:20 AM Files deleted: 0
3/17/2008 5:48:25 AM Engine version = 5200.2160
3/17/2008 5:48:25 AM AntiVirus DAT version = 5252.0000
3/17/2008 5:48:25 AM Number of detection signatures in EXTRA.DAT = None
3/17/2008 5:48:25 AM Names of detection signatures in EXTRA.DAT = None

3/17/2008 2:48:28 PM Statistics:
3/17/2008 2:48:28 PM Files scanned: 32599
3/17/2008 2:48:28 PM Files detected: 0
3/17/2008 2:48:28 PM Files cleaned: 0
3/17/2008 2:48:28 PM Files deleted: 0
3/18/2008 6:09:35 AM Engine version = 5200.2160
3/18/2008 6:09:35 AM AntiVirus DAT version = 5252.0000
3/18/2008 6:09:35 AM Number of detection signatures in EXTRA.DAT = None
3/18/2008 6:09:35 AM Names of detection signatures in EXTRA.DAT = None
3/18/2008 6:21:39 AM Engine version = 5200.2160
3/18/2008 6:21:39 AM AntiVirus DAT version = 5253.0000
3/18/2008 6:21:39 AM Number of detection signatures in EXTRA.DAT = None
3/18/2008 6:21:39 AM Names of detection signatures in EXTRA.DAT = None
3/18/2008 6:21:39 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Program Files\Common Files\McAfee\Engine\avvnames.dat
3/18/2008 6:22:04 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Program Files\Common Files\McAfee\Engine\avvclean.dat
3/18/2008 6:22:05 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\Agent_FMSLB.xml
3/18/2008 6:22:05 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Program Files\Common Files\McAfee\Engine\avvscan.dat

3/18/2008 11:31:26 AM Statistics:
3/18/2008 11:31:26 AM Files scanned: 8260
3/18/2008 11:31:26 AM Files detected: 0
3/18/2008 11:31:26 AM Files cleaned: 0
3/18/2008 11:31:26 AM Files deleted: 0
3/19/2008 10:39:48 AM Engine version = 5200.2160
3/19/2008 10:39:48 AM AntiVirus DAT version = 5253.0000
3/19/2008 10:39:48 AM Number of detection signatures in EXTRA.DAT = None
3/19/2008 10:39:48 AM Names of detection signatures in EXTRA.DAT = None
3/19/20083/19/2008 10:49:53 AM Engine version = 5200.2160
3/19/2008 10:49:54 AM AntiVirus DAT version = 5254.0000
3/19/2008 10:49:54 AM Number of detection signatures in EXTRA.DAT = None
3/19/2008 10:49:54 AM Names of detection signatures in EXTRA.DAT = None
10:49:53 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Program Files\Common Files\McAfee\Engine\avvnames.dat
3/19/2008 10:49:59 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Program Files\Common Files\McAfee\Engine\avvscan.dat
3/19/2008 10:49:59 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Current\SPAMSAFE1000\SK_det.mcs
3/19/2008 10:49:59 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\Agent_FMSLB.xml

Thanks,
Craig
tonyb99
Level 13
Report Inappropriate Content
Message 4 of 20

RE: Scan timed Out events

Your scan is timing out on files that would be in use when the VSE was updating, the logs tend to indicate that this is an on demand scan??
You could move your update schedule outside of the scan schedule.

What patch level of VSE are you using? (patch 0 wasnt much cop at letting update files go when finished with them)

RE: Scan timed Out events



We are at Patch 5, and it looks like the Alerts are being reported from the On Aceess Scanner. So I really can't move schedules around.

I would think that more people would see these alerts here, i don't want to feel like the only one! hah

RE: Scan timed Out events

same problem for us and no solution found ! VSE 8.5 Patch5. We had the same error with patch4.

Any idea ? Thanks :confused:
badaz06
Level 7
Report Inappropriate Content
Message 7 of 20

RE: Scan timed Out events

Within VSE you do have the ability to exclude specific files or directories from scanning (for example, overly large files that you feel are safe). Files that timeout on scan are reported as infected as a precaution, since technically the scan can't verify that they aren't.
Highlighted

RE: Scan timed Out events

So has anyone found a solution for this? We just started having the same issues after upgrading to McAfee Antivirus 8.5. Our Malware Detection History is up to 30,000 events and climbing. All help is greatly appreciated.
tonyb99
Level 13
Report Inappropriate Content
Message 9 of 20

RE: Scan timed Out events

I dont let EPO report on scan timeouts, you just turn event off from the central reporting, still gets logged locally of course but thats usefull sometimes.

EPO 4.0 - configration/server setting/event filtering/edit
EPO 3.6 - events option at bottom of reporting threads

RE: Scan timed Out events




Thanks for that info. I will give that a try.
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community