3 Replies Latest reply on Oct 16, 2008 11:05 AM by cmajewsk

    VirusScan 8.5 Access Protection rule issue.

      Installed 8.5 P6 and I am seeing entries in the Access Protection Log like:

      10/15/2008 9:22:21 PM Blocked by Access Protection rule DOMAIN\user C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE \REGISTRY\USER\S-1-5-21-957578113-1565271767-774919444-4774\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect Anti-spyware Standard Protection:Protect Internet Explorer favorites and settings Action blocked : Create

      10/15/2008 3:45:00 PM Blocked by Access Protection rule DOMAIN\user C:\Program Files\Microsoft Office Communicator\communicator.exe C:\Documents and Settings\username\Application Data\Microsoft\Network\Connections\Pbk\rasphone.pbk Anti-virus Maximum Protection:Protect phonebook files from password

      Is it worth keeping these rule enacted when it's blocking (blocking what I have no idea?) legitimate Microsoft office programs from doing various operations? Also, is there a way to stop the little yellow "i" from popping inside the M icon in the systray?
        • 1. RE: VirusScan 8.5 Access Protection rule issue.
          I see no reason to keep those particular rules active.. If you want to test your options, change the settings to "Alert" instead of "block" and see how it goes.. Unfortunately, even setting as "Alert" will cause the McAfee icon to start flashing it's warning.. The only way to prevent that is to UNCHECK the selection in the Access Protection rules which apply.

          Hope this helps.

          Grif
          • 2. RE: VirusScan 8.5 Access Protection rule issue.


            this is kind of a bummer. while most users pay no attention to this (unfortunately), some are pro-active and want to be sure everything is OK when the icon flashes. there are some events which we would like to keep logged as they can be useful for troubleshooting issues (port blocking, etc), but at the same time we don't want to condition the user base to often having false positives.

            i wish there was a separate option for this action. sad
            • 3. RE: VirusScan 8.5 Access Protection rule issue.


              I guess my biggest questions to that would be:

              If I uncheck them to just alert, what is the rule now NOT going to block that may be harmful?

              Why are the legitimate apps that it will not let write to the registry, and so forth not being affected in a way I can see?