VSE 8.8 (or, another McAfee AV product) is corrupting program execution

[azjazz]

Hi - I have VSE 8.8 (along with ePO and HIPS) installed on my Windows XP (SP3) work computer.

I run a program called "Android-Sync" to syncronize my MS Outlook information to my Android phone. As part of Android-Sync's normal operation, it invokes the adb.exe (Android Debug Bridge) command in a separate Windows process when I connect my phone to the PC via USB.

While Android-Sync mostly works fine, there is a problem being introduced by a McAfee AV product (I'm not sure which one): While Android-Sync and the invoked adb.exe appear to operate properly, the invoked adb.exe command "hangs" and never terminates properly when I disconnect my phone. So each hung instance of adb.exe appears in my WIndows Task Manager, and I manually have to kill each instance whenever I shut down my computer. Sometimes, I have to manually kill 20 or more instances, which takes a lot of time and gets very annoying.

I know that McAfee is involved with this failure in some way. When I uninstalled McAfee temporarily from my computer, each instance of adb.exe was terminated properly when I disconnected my phone.

How do I configure McAfee to allow adb.exe / Android-Sync to operate normally without McAfee blocking some of its operation?

Thanks,

Alan

[bzielin]

see if setting it as a low-risk process and uncheck read and write fixes it.

[azjazz]

Thanks, bzielin - I'm assuming that the Low-Risk process setting is under the VSE On-Access Scan >> Properties >> General tab, and then I browse for Android-Sync.exe and adb.exe?

Where is the spot in the settings where I uncheck Read and Write at?

Message was edited by: azjazz on 9/27/13 1:11:11 AM CDT

[sathish.l · Accepted solution]

Hi Jazz,

You can add those process names in "Low risk process" under exclusion tab. There you will get read and write options.

[azjazz]

Thanks, bzielin and sathish.l - your suggestions were great, and probably would work, but ...

I think I may be skrood.

Whenever I connect my PC back to my work network, my "Exclusion" settings seem to disappear. I think that some work-managed settings overwrite any of my changes.

Am I out of luck?

[pato]

No you aren't. Just tell your EPO manager that he should add those exclusions to the globald (company wide) exclusion list, or make a special policy for you.

[mgg]

I am surprised it is permitted to make local changes given it 'appears'  to be a centrally managed environment

There is a McAfee tool: McAfee Profiler, that can be used to identify 'AV' activity in relation to the processes and general file-system related I/O - might help confirm.