1 2 Previous Next 13 Replies Latest reply on Jul 15, 2010 3:06 PM by D43m0n

    McAfee VirusScan Enterprise 8.5.0i + ScriptScan

      Hello, we are using McAfee VirusScan Enterprise 8.5.0i. Here is the problem - ScriptScan, when enabled, is sucking up massive amounts of CPU whenever a certain webapp is run. However, we do not have permission to disable it entirely or create an exclusion for iexplore.exe due to security issues.

      Is there any way to exclude specific web addresses from ScriptScan, or disable it for local addresses only?

      Thanks,
      - Unition

      Moved from "VirusScan 8 & Previous Versions" (Home) to "Desktop & Server" (Enterprise - Corporate) for better attention - MOD
        • 2. RE: McAfee VirusScan Enterprise 8.5.0i + ScriptScan
          Hello,
          We have the same problem.
          When we disable ScriptScan, our Intranet website (developped in aspx) is fast (4 seconds for giving the request result), but when we enable ScriptScan, results come 25 seconds later :(

          Any idea in order to add a website in exclusion of ScriptScan ?

          Thanks a lot.
          • 3. RE: McAfee VirusScan Enterprise 8.5.0i + ScriptScan
            tonyb99
            No there is no functionality to add a website exclusion
            • 4. McAfee VirusScan Enterprise 8.7.0i + ScriptScan
              runcmd

              We have an internal browser-based application that is experiencing performance issues related to ScriptScan.  If ScriptScan is enabled, page loads take about 10 seconds.  When ScriptScan is disabled, page loads are 2 seconds.  Every time the user tries to navigate inside the application, they have to wait 10 seconds while ScriptScan does whatever it happens to be doing.  This is adding up to a significant amount of time that the user spends waiting for the application to respond.  In addition, because it is a web-based application, the only process name I can use for a ScriptScan exclusion is the web browser itself (iexplore.exe).  The workstations that access this application are also used for internet web browsing, which makes the risk associated with adding an exclusion for the process almost the same as just disabling ScriptScan.  Has anyone come up with a solution for performance degradation in web-based applications, as associated with ScriptScan?

               

              An idea that came to mind:  If I can launch the application in Internet Explorer as a separate process, giving IE a unique name, I could then exclude that process name from ScriptScan.  However, in experimenting, I have been unsuccessful in changing IE's process name.  If I copy "iexplore.exe" to "testie.exe", it does not launch at all.  Does anyone know of a way to change IE's process name, with an end result of two IE sessions running simultaneously under unique names--for example, one as "iexplore.exe" and another as "testie.exe"?  (If I copy "firefox.exe" to "testff.exe", Firefox will run with a process name of "testff.exe" but not simultaneously with "firefox.exe".)

               

              Thanks!

              • 5. Re: McAfee VirusScan Enterprise 8.7.0i + ScriptScan
                rmetzger

                runcmd wrote:

                 

                We have an internal browser-based application that is experiencing performance issues related to ScriptScan.  If ScriptScan is enabled, page loads take about 10 seconds.  When ScriptScan is disabled, page loads are 2 seconds.  Every time the user tries to navigate inside the application, they have to wait 10 seconds while ScriptScan does whatever it happens to be doing.  This is adding up to a significant amount of time that the user spends waiting for the application to respond.  In addition, because it is a web-based application, the only process name I can use for a ScriptScan exclusion is the web browser itself (iexplore.exe).  The workstations that access this application are also used for internet web browsing, which makes the risk associated with adding an exclusion for the process almost the same as just disabling ScriptScan.  Has anyone come up with a solution for performance degradation in web-based applications, as associated with ScriptScan?

                 

                An idea that came to mind:  If I can launch the application in Internet Explorer as a separate process, giving IE a unique name, I could then exclude that process name from ScriptScan.  However, in experimenting, I have been unsuccessful in changing IE's process name.  If I copy "iexplore.exe" to "testie.exe", it does not launch at all.  Does anyone know of a way to change IE's process name, with an end result of two IE sessions running simultaneously under unique names--for example, one as "iexplore.exe" and another as "testie.exe"?  (If I copy "firefox.exe" to "testff.exe", Firefox will run with a process name of "testff.exe" but not simultaneously with "firefox.exe".)

                 

                Thanks!

                 

                Hi RunCMD,

                 

                Consider WhiteListing your intranet site.

                see: https://kc.mcafee.com/corporate/index?page=content&id=KB65382&actp=search&viewlo cale=en_US&searchid=1278011200919 for details "whitelisting of URLs" within ScriptScan when using VSE v8.7i P1 or later (or 8.5i with Patch 8).

                 

                Hope this helps.

                Ron Metzger

                • 6. Re: McAfee VirusScan Enterprise 8.7.0i + ScriptScan
                  runcmd

                  OUTSTANDING!!!  Thank you!  This looks like it's exactly what I needed! 

                  • 7. Re: McAfee VirusScan Enterprise 8.7.0i + ScriptScan
                    rmetzger

                    runcmd wrote:

                     

                    OUTSTANDING!!!  Thank you!  This looks like it's exactly what I needed! 

                    Great! Let us know how you make out.

                     

                    Thanks,

                    Ron Metzger

                    • 8. Re: McAfee VirusScan Enterprise 8.7.0i + ScriptScan

                      Hello All,

                       

                      I am also looking to whitelist a URL for an internal site. I am trying to push the registry setting out to clients through ePO by using a SuperDAT as indicated in the article. I am having trouble creating a SuperDAT that just distibutes the registry setting and nothing else. Has anyone else tried this? Looking to see if someone can point me in the right direction.

                       

                      Thanks

                      • 9. Re: McAfee VirusScan Enterprise 8.7.0i + ScriptScan
                        rmetzger

                        D43m0n wrote:

                         

                        Hello All,

                         

                        I am also looking to whitelist a URL for an internal site. I am trying to push the registry setting out to clients through ePO by using a SuperDAT as indicated in the article. I am having trouble creating a SuperDAT that just distibutes the registry setting and nothing else. Has anyone else tried this? Looking to see if someone can point me in the right direction.

                         

                        Thanks

                        Well, I have never made a 'SuperDAT' file before, so I can't help much here. I tend to use McAfee Installation Designer to create configuration changes that I can then deploy via several means.

                         

                        If you want to use the 'SuperDAT' method, I would suggest talking to your McAfee support representative and ask to have this SuperDAT created for you.

                         

                        Not much help, sorry.

                        Ron Metzger

                        1 2 Previous Next