We are experiencing an odd issue with the "McAfee Encrypted USB by Sandisk" devices we've purchased.
They are managed via ePO, and we've (currently) elected to enable the built in malware scanner.
However, the malware scanner is stripping out macros from Excel documents when they are copied/saved onto the memory stick.
This uses the same DAT/Engine as VirusScan Enterprise, yet VirusScan isn't stripping the macros out of the files.
I did log a call with McAfee support, their only suggestions were... (a) submit a PER to get more configurability for the malware scanner via epo, (b) disable malware scanning for the memory sticks. and (c) submit sample file to AVERT.
I've submitted the PER, and also the sample to AVERT. (via webimmune.net). The sample, unsurprisingly comes back as inconclusive with a note that it doesn't contain any known threats.
So, i'm puzzled as to why the memory stick malware scanner is stripping macros out and yet no other AV product we have is finding any issues at all.
For ref, i tested with a very simple excel file where the macro just concatenates the data in 2 cells.
Has anyone else seen similar behaviour ?
I'm tempted to log the call again with mcafee support, as i'd rather not have to turn off the malware protection.