First some explanation of our setup:
We have 3 servers (2 Windows 2003 and 1 Windows 2008 R2), that are being used for our out-of-band scanning for our NAS (EMC² Celerra VG2).
The three servers are basically a vanilla windows install with EMC CAVA tools on it (divides the scaning load accross the three servers) and Virusscan Enterprise 8.8 Patch 1 (ofcourse with an ePO-agent)
Alle 3 servers are getting the same policy from the ePO-server.
We now see the following.
On our Windows 2003 server everything works fine, sometimes we get an informational that something took to long to scan (eventid 257) (mostly a zipfile), but that's all.
On our Windows 2008 R2 we get a lot of eventid 5051: "A thread in process C:\Program Files\Mcafee\SystemCore\mcshield.exe took longer than 90000ms to complete a request". And as a result mcshield terminates unexpectedly and we have to wait until it restarts. This occurs several times a day. Mostly on dll's found on the NAS (our developers sometimes copy their code to their home-folder).
Is there something we are overlooking when scanning dll's with Virusscan on Windows 2008 R2?
We've removed the Windows 2008 R2 machine from the pool so the scanning is done on the Windows 2003 machines only and if we force a scan of a dll that made the Windows 2008 R2 machine crash it works like a charm.