2 Replies Latest reply on Sep 7, 2009 7:31 PM by rmetzger

    False Positives + Ignoring Exclusions


      I'm currently trying to install ArcSoft Total Media Theatre onto a PC that is on a network managed by ePO with VirusScan Enterprise on the machine. However, it keeps thinking that part of the installation is a virus:

      7/5/2009 6:17:32 PM Deleted -removed-H:\Program Files\ArcSoft\TotalMedia Theatre\uDigital Theatre.exe H:\Program Files\ArcSoft\TotalMedia Theatre\Plugins\VideoModule\PlayDVD\UI\Media_01.aui W32/Autorun.worm!l (Virus)
      7/5/2009 6:20:53 PM Deleted -removed- M:\PROGRA~1\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe H:\Program Files\ArcSoft\TotalMedia Theatre\Plugins\VideoModule\PlayDVD\UI\Medid02d.rra W32/Autorun.worm!l (Virus)
      7/5/2009 6:22:56 PM Deleted -removed-M:\PROGRA~1\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe H:\Program Files\ArcSoft\TotalMedia Theatre\Plugins\VideoModule\PlayDVD\UI\Mediaf6c.rra W32/Autorun.worm!l (Virus)

      If you check the ArcSoft forum this appears to be a problem with certain antivirus products that has been fixed in most of them years ago - why has McAfee not solved this problem?!

      Additionally if I tell it to exclude H:\Program Files\ArcSoft\TotalMedia Theatre\ and all subfolders from the on access scan it still comes up as a virus.

      How can I solve this problem?


        • 1. RE: False Positives + Ignoring Exclusions
          I'm having the same issue. Mcafee keeps finding trojans in my TMT software, even on a clean install. McAfee totally ignoring the issue is, to say the least, quite annoying.

          What I want is to simply exclude the entire C:\Program Files\ArcSoft\ tree from McAfee's faulty and instrusive meddling.
          • 2. RE: False Positives + Ignoring Exclusions

            Exclude: **\ArcSoft\TotalMedia Theater\ and check sub-folders. (Note the trailing \ character. This is critical. Otherwise end it with \*.* as this would do the same.)
            This excludes All Files in this folder and sub-folders on all drives and at any level.

            As I have listed it, the folder name must start at '**\ArcSoft\TotalMedia Theater\' on any drive letter. This could be on any root folder such as \Program Files\, \Programs\, \Documents and Settings\, \Users\, or even \, and on deeper levels as well.

            See this Tutorial https://kc.mcafee.com/content/tutorials/vse/vse_rc_613265.htm
            It applies to VSE 8.7i as well, though was written for VSE 8.5i.

            This will not work for the Retail/Consumer version(s) of VirusScan as I believe the Retail versions do not provide this level of control.

            This exclusion should be replicated at each type of scan where detection should be excluded. This would include On-Demand scans (Full Scan, On-Demand, or other custom scans) in addition to the On-Access scan. Each scan is customizable independently, for greater administrator control. So make sure you check that the exclusions are correct for each form of scan within the VSE Console.

            Other related links:
            http://community.mcafee.com/showthread.php?t=229802 where exclusions are widely discussed.

            Let us know if this helps.
            Ron Metzger