1 2 Previous Next 19 Replies Latest reply on Oct 13, 2009 10:03 AM by RichardJC

    Scan timed Out events

      Hello, we've recently started using vse85i sp5 with EPO 4 and I am seeing a lot of the following events reported from my clients, can someone tell me why? I just think it throws off the reporting.

      Thanks in advance!
      Craig


      File Path C:\Program Files\Common Files\McAfee\Engine\avvclean.dat
      Event Category Malware
      Event ID 1059
      Threat Severity Alert
      Threat Name
      Threat Type virus
      Action Taken None
      Threat Handled false
      Analyzer Detection Method OAS

      Event Descriptions

      Event Description Scan Timed Out
        • 1. RE: Scan timed Out events
          tonyb99
          So the OAS scanning is timing out while scanning its own DAT files, what are your time out settings on OAS?
          • 2. RE: Scan timed Out events


            The timeout settings are 45 seconds, which should be the default. I did not change too many settings from default.

            Also, here is a sample log from another pc, its not just the dat file.


            3/15/2008 11:54:20 AM Statistics:
            3/15/2008 11:54:20 AM Files scanned: 853
            3/15/2008 11:54:20 AM Files detected: 0
            3/15/2008 11:54:20 AM Files cleaned: 0
            3/15/2008 11:54:20 AM Files deleted: 0
            3/17/2008 5:48:25 AM Engine version = 5200.2160
            3/17/2008 5:48:25 AM AntiVirus DAT version = 5252.0000
            3/17/2008 5:48:25 AM Number of detection signatures in EXTRA.DAT = None
            3/17/2008 5:48:25 AM Names of detection signatures in EXTRA.DAT = None

            3/17/2008 2:48:28 PM Statistics:
            3/17/2008 2:48:28 PM Files scanned: 32599
            3/17/2008 2:48:28 PM Files detected: 0
            3/17/2008 2:48:28 PM Files cleaned: 0
            3/17/2008 2:48:28 PM Files deleted: 0
            3/18/2008 6:09:35 AM Engine version = 5200.2160
            3/18/2008 6:09:35 AM AntiVirus DAT version = 5252.0000
            3/18/2008 6:09:35 AM Number of detection signatures in EXTRA.DAT = None
            3/18/2008 6:09:35 AM Names of detection signatures in EXTRA.DAT = None
            3/18/2008 6:21:39 AM Engine version = 5200.2160
            3/18/2008 6:21:39 AM AntiVirus DAT version = 5253.0000
            3/18/2008 6:21:39 AM Number of detection signatures in EXTRA.DAT = None
            3/18/2008 6:21:39 AM Names of detection signatures in EXTRA.DAT = None
            3/18/2008 6:21:39 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Program Files\Common Files\McAfee\Engine\avvnames.dat
            3/18/2008 6:22:04 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Program Files\Common Files\McAfee\Engine\avvclean.dat
            3/18/2008 6:22:05 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\Agent_FMSLB.xml
            3/18/2008 6:22:05 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Program Files\Common Files\McAfee\Engine\avvscan.dat

            3/18/2008 11:31:26 AM Statistics:
            3/18/2008 11:31:26 AM Files scanned: 8260
            3/18/2008 11:31:26 AM Files detected: 0
            3/18/2008 11:31:26 AM Files cleaned: 0
            3/18/2008 11:31:26 AM Files deleted: 0
            3/19/2008 10:39:48 AM Engine version = 5200.2160
            3/19/2008 10:39:48 AM AntiVirus DAT version = 5253.0000
            3/19/2008 10:39:48 AM Number of detection signatures in EXTRA.DAT = None
            3/19/2008 10:39:48 AM Names of detection signatures in EXTRA.DAT = None
            3/19/20083/19/2008 10:49:53 AM Engine version = 5200.2160
            3/19/2008 10:49:54 AM AntiVirus DAT version = 5254.0000
            3/19/2008 10:49:54 AM Number of detection signatures in EXTRA.DAT = None
            3/19/2008 10:49:54 AM Names of detection signatures in EXTRA.DAT = None
            10:49:53 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Program Files\Common Files\McAfee\Engine\avvnames.dat
            3/19/2008 10:49:59 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Program Files\Common Files\McAfee\Engine\avvscan.dat
            3/19/2008 10:49:59 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\McScript_InUse.exe C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Current\SPAMSAFE1000\SK_det.mcs
            3/19/2008 10:49:59 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\Agent_FMSLB.xml

            Thanks,
            Craig
            • 3. RE: Scan timed Out events
              tonyb99
              Your scan is timing out on files that would be in use when the VSE was updating, the logs tend to indicate that this is an on demand scan??
              You could move your update schedule outside of the scan schedule.

              What patch level of VSE are you using? (patch 0 wasnt much cop at letting update files go when finished with them)
              • 4. RE: Scan timed Out events


                We are at Patch 5, and it looks like the Alerts are being reported from the On Aceess Scanner. So I really can't move schedules around.

                I would think that more people would see these alerts here, i don't want to feel like the only one! hah
                • 5. RE: Scan timed Out events
                  same problem for us and no solution found ! VSE 8.5 Patch5. We had the same error with patch4.

                  Any idea ? Thanks :confused:
                  • 6. RE: Scan timed Out events
                    Within VSE you do have the ability to exclude specific files or directories from scanning (for example, overly large files that you feel are safe). Files that timeout on scan are reported as infected as a precaution, since technically the scan can't verify that they aren't.
                    • 7. RE: Scan timed Out events
                      So has anyone found a solution for this? We just started having the same issues after upgrading to McAfee Antivirus 8.5. Our Malware Detection History is up to 30,000 events and climbing. All help is greatly appreciated.
                      • 8. RE: Scan timed Out events
                        tonyb99
                        I dont let EPO report on scan timeouts, you just turn event off from the central reporting, still gets logged locally of course but thats usefull sometimes.

                        EPO 4.0 - configration/server setting/event filtering/edit
                        EPO 3.6 - events option at bottom of reporting threads
                        • 9. RE: Scan timed Out events



                          Thanks for that info. I will give that a try.
                          1 2 Previous Next