4 Replies Latest reply on Dec 31, 2013 4:36 AM by Laszlo G

    Mcaffee blocking httpd.exe

    bgbs

      Mcaffee, which is run on our webserver is blocking apache\Apache2.2\bin\httpd.exe

      Essentially it prevents webserve to send out email alerts when a webform gets submitted by user.  When we uninstalled Mcaffee, everything was working fine. Installed Mcaffee back up, and email alerts do not work.

      Here is the full log error:

      12/21/2013          5:48:29 PM          Blocked by port blocking rule   C:\Program Files\apache\Apache2.2\bin\httpd.exe          Anti-virus Standard Protection:Prevent mass mailing worms from sending mail 000.000.000.000 (ip) 

       

      I added httpd.exe to whitelist (Process to Exclude list), but the problem still persists. Any ideas what must I do to solve this problem?

       

      Message was edited by: bgbs on 12/30/13 3:41:59 PM CST
        • 1. Re: Mcaffee blocking httpd.exe
          wwarren

          bgbs wrote:

           

          I added httpd.exe to whitelist (Process to Exclude list), but the problem still persists. Any ideas what must I do to solve this problem?

           

          How did you add it to the list exactly?

           

          You describe taking the right steps to correct the issue; that you say it's not working means your steps are a bit off.

          • 2. Re: Mcaffee blocking httpd.exe
            bgbs

            Mcaffee has a window called "Processes to Exclude"  httpd.exe was added to that list.  My webserver logs say that port 25 is getting blocked.  So I think httpd.exe on port 25 is getting blocked by Mcaffee.

             

            Message was edited by: bgbs on 12/30/13 3:52:25 PM CST
            • 3. Re: Mcaffee blocking httpd.exe
              wwarren

              Are you doing this via ePO, or locally on the server where VSE is installed?

              You need to confirm if doing it via ePO that you are updating the correct policy.

              You need to confirm if doing it locally that the change is not being overwritten by policy enforcement.

               

              If you need help with either of these things, or you're adamant you're doing it right but something else could be failing (like policies not reaching the client), then you ought to contact McAfee Support.

              • 4. Re: Mcaffee blocking httpd.exe
                Laszlo G

                Are you using the exclusion list under On-access scanner settings or under Access protection settings?

                 

                You have to use the one under Access Protection->Anti-Virus Standard protection->Prevent mass-mailing worms from sending mails and put the httpd.exe process into the excluded processes list.

                 

                If you already did it then look what wwarren says about an ePO-managed node or not.