6 Replies Latest reply on Feb 21, 2008 4:46 AM by tonyb99

    VirusScan 8.5i blocked a Data Transfer

      Good morning,

      I'm from Germany, and I'm sorry for my bad english
      I will try to describe our issue.

      WinXP / McAfee is running on a server - clients got the program from the server

      We have a program called "Orbis". In this program we started a Datatransfer. During the transfer, the transfer stopped. When we disable in the virus scan console the access protection and start the data transfer again, the transfer is ok.

      Have you any idea where i can find some information what get blocked?
      I tried to exclude C:\ but we got the same issue.
      Any other idea?

      Thank you

      aCryL
        • 1. RE: VirusScan 8.5i blocked a Data Transfer
          tonyb99
          C:\Documents and Settings\All Users\Application Data\McAfee\DesktopProtection

          or

          C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan

          Check the access protection log.txt for the time you did the transfer when it failed and you will see what rule was being broken, then you can figure out what to exempt if neccessary.

          (I mean check the logs on the server you were copying to)
          • 2. RE: VirusScan 8.5i blocked a Data Transfer
            I have searched on local machine, on terminal server and on application server for the logs, but i can't find any entry in the log files.

            Do you have any other idea?

            Perhaps it is an issue/a conflict betreen the Programm Orbis and McAfee, perhaps there get nothing blocked... perhaps incompatible, i don't now ... here a picture from the bug:



            When we disable in the virus scan console the access protection and start the data transfer again, the transfer is ok.
            • 3. RE: VirusScan 8.5i blocked a Data Transfer
              tonyb99
              Use trial and error

              reenable OAS but leave access protection off then try it
              reenable access protection but set to notify not block on rules you use
              now monitor logs
              • 4. RE: VirusScan 8.5i blocked a Data Transfer
                what do you mean with "set to notify not block on rules you use
                now monitor logs " can you describe it a little bit easier, i don't understand that... thank's
                • 5. RE: VirusScan 8.5i blocked a Data Transfer
                  tonyb99
                  For each rule in access protection you will see a tick check for block and also for report, if you remove the block option but leave the report option then you should be able to run your transfer and then check the access protection log to see what rule it was tripping (as it will still be reporting)

                  then you can work out what exemption you need and create this (making sure to add any blocks that you need back in.

                  (obviously with epo managed systems you will want to make these changes as a policy that is enforced on that machine)
                  • 6. RE: VirusScan 8.5i blocked a Data Transfer
                    tonyb99
                    and the logs are as prev posted:

                    C:\Documents and Settings\All Users\Application Data\McAfee\DesktopProtection

                    or

                    C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan

                    look for the accessprotectionlog.txt