Release Notes for McAfee® VirusScan® Enterprise 8.7i

Support for Microsoft Windows Server 2008

This release provides support for Windows Server 2008 (Longhorn).

Architectural changes

Real-time malware protection

Performance improvements

Improved email scanner

The email scanner now supports double-byte and multi-byte languages. This improves detection reliability.

Buffer overflow protection exclusions by API

The ability to specify buffer overflow exclusions by API was removed from VirusScan Enterprise 8.5i, but has been reinstated for the VirusScan Enterprise 8.7i release. The API exclusion name is case-sensitive.

On-access scanner — Scan processes on enable

A new feature, Scan processes on enable, scans processes that are already running when the McShield service becomes enabled. When the McShield service starts, the scanner examines any process that is already running and any process as it is launched.

On-demand scan usability improvements

Installation

• Issue

  The 64-bit version of Panda Antivirus 2008 is not removed during the VirusScan Enterprise installation. During the VirusScan Enterprise standalone product installation, the user is notified to manually remove the product. During silent installation, such as deployment via ePolicy Orchestrator, the VirusScan Enterprise installation fails with no notification. In either case, the user must manually uninstall the 64-bit version of Panda Antivirus 2008, then reinstall VirusScan Enterprise.

• Issue

  We do not recommend installing VirusScan Enterprise 8.7i on a system where the VirusScan for NetApp 7.1 Console is running. If you do, the VirusScan for NetApp 7.1 Console is disabled. This behavior is expected because of the impending release of VirusScan Enterprise for Storage, which is a replacement for VirusScan for NetApp 7.1.

• Issue

  To install the VirusScan Enterprise 8.7i Reporting .NAP file in ePolicy Orchestrator 3.6.1, complete these steps:
  

  1. Use the ePolicy Orchestrator Check-In Wizard to add the VSE870Reports.NAP file to the repository.

  2. If applicable, log out of the Reporting console.

  3. In the ePolicy Orchestrator installation directory, delete the REPORTVERSIONS.SQL file from the AVI directory.

  4. Log in to the Reporting console using ePO Authentication.

  5. Click Yes to download the new reports.

Migrating policies and events in ePolicy Orchestrator

• Issue

  The Policy Migration tool (ePOPolicyMigration.exe) upgrades VirusScan Enterprise polices and tasks from an earlier version of VirusScan Enterprise. This tool runs only one time per server. If you have both the VirusScan Enterprise 8.0i .NAP file and the 8.5i .NAP or extension installed on the same server, you must choose whether to upgrade policies and tasks from VirusScan Enterprise 8.0i or 8.5i. You cannot upgrade both.

  Choose only one of these upgrade scenarios:
  

  • When upgrading VirusScan Enterprise 8.5i policies and tasks in ePolicy Orchestrator 3.6.1, first check in the .NAP file, then execute the Policy Migration tool on the server.

  • When upgrading VirusScan Enterprise 8.5i policies and tasks in ePolicy Orchestrator 4.0, first check in the extension, then execute the Policy Migration tool on the server.

  • When upgrading VirusScan Enterprise 8.0i policies and tasks, use the command-line option with the force switch as follows: ePOPolicyMigration.exe /force80

  NOTE: You can upgrade more than one version of the VirusScan Enterprise software to a later version in ePolicy Orchestrator, but you can upgrade only one version of VirusScan Enterprise policies and tasks to a later version.

• Issue

  Some Access Protection policies do not migrate when using ePOPolicyMigration.exe to migrate VirusScan Enterprise policies from an older version to a newer version of the product. See McAfee Support KnowledgeBase article 616156 for more information about this issue.

• Issue

  VirusScan Enterprise 8.7i events do not appear after migrating from ePolicy Orchestrator 3.6.1 to ePolicy Orchestrator 4.0. See McAfee Support KnowledgeBase article 616597 for more information about this issue.

Supported platforms and products

This version of VirusScan Enterprise supports Lotus Notes version 6.0x, 6.5, and 7.0x. See the VirusScan Enterprise 8.7i installation guide for information about supported operating systems.

Compatibility with other products

• Issue

  When VirusScan Enterprise 8.7i is installed on a system that is also protected by McAfee Network Access Control (McAfee NAC), a DAT compliance issue might occur if the DAT version included in VirusScan Enterprise 8.7i is older than the age configured in the McAfee NAC policy. If the DAT version exceeds this age, McAfee NAC quarantines the system until remediation steps are taken by the administrator or user. In most cases, remediation requires a restart.

  Both products are working as expected. There are two options to address this issue:
  

  • No change to McAfee NAC policies. The administrator can decide whether to install VirusScan Enterprise 8.7i with out-of-date DAT files and risk quarantining the system. For quarantined client systems that are managed by ePolicy Orchestrator, the administrator can still install VirusScan Enterprise 8.7i on the quarantined system and/or update the DAT file.

  • Run McAfee NAC in Audit mode. This allows client systems to be scanned and reported on, without risking quarantine from the DAT compliance issue. In this scenario, we recommend that all McAfee NAC policies be configured to run in Audit mode.

• Issue

  After installing VirusScan Enterprise 8.7i to a system where McAfee NAC 3.0 is installed, an infrequent failure might occur, preventing identification of McAfee services. You might see these symptoms:
  

  • A specified driver is invalid message is logged if you perform an update task before restarting.
  • A driver failed to load message is logged for one or both products.

  • The local system application event log contains event ID 5004.

  To resolve this issue, uninstall the failed product, restart the system, then reinstall the product.

• Issue

  NVIDIA^® drivers might cause performance issues or system response failure. VirusScan Enterprise 8.7i might run at 100% CPU or cause the system to fail to respond when running on specified NVIDIA drivers. See KnowledgeBase articles 614212 and 65066 for more information about this issue.

• Issue

  When taking action on threatened items detected on an EMC filer, we recommend using only Clean and Delete action options. Do not use the Deny access action option. The implementation of the anti-virus protection between VirusScan Enterprise and EMC requires that a Clean or Delete action be taken to protect detected threats. Deny access does not take any action and allows the detected item to be accessed again.

Updating

• Issue

  The update task fails the first time after any system restart when running VirusScan Enterprise 8.7i on a system with Microsoft Windows 2000 Professional and Server operating systems. In this scenario, the update task fails the first time after every manual or scheduled system restart and might also occur when a manual update is performed after the system is left running for days. Subsequent update tasks are successfully performed in either case. If an update task fails in this scenario, start another update task or wait for the next scheduled task to be performed.

• Issue

  Update might fail when using a mirror repository that was created using VirusScan Enterprise 8.7i and a new installation of McAfee Agent version 4.0. In this scenario, the Sitelist.xml file is not found. This issue does not occur when upgrading the agent on an ePolicy Orchestrator-managed client computer from ePolicy Orchestrator agent 3.6.1 to McAfee Agent version 4.0.

  NOTE: McAfee Agent was previously known as ePolicy Orchestrator agent.

• Issue

  Failure to access the repository is not logged in the VirusScan Enterprise 8.7i update log, but the failure is logged in the McAfee Agent log. The default location of the McAfee Agent log is: <drive>:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\ mcscript.log.

• Issue

  Silent update tasks performed from the command line still display the progress dialog box. The installation successfully completes, but the Update in progress dialog box appears when you run “setup.exe /q RUNAUTOUPDATESILENTLY=TRUE” from the command line.

• Issue

  We recommend using single-byte characters when naming folders for mirror site locations on localized systems. If you use double-byte or extended characters when naming folders for mirror site locations on localized systems, the folder name might change after specifying the folder name in the Mirror Location text box. This issue is in the McAfee Agent and expected to be fixed in a later version of the McAfee Agent.

• Issue

  Importing the Sitelist.xml file from the command line might fail. When you run “setup.exe CMASOURCEDIR="<drive>:\Documents and Settings\<username>\Desktop\“ from the command line to install the product and import the Sitelist.xml file from the Desktop, the installation successfully completes but fails to import the Sitelist.xml file.

  To resolve this issue, use a Sitelist.xml file that was created by ePolicy Orchestrator agent 3.6.1. If the McAfee Agent 4.0 installation "upgraded" a previous installation of ePolicy Orchestrator agent 3.6.1, then it will produce a correct Sitelist.xml that can be imported by VirusScan Enterprise 8.7i.

Remote console

• Issue

  When using the remote console feature to open Access Protection properties on a system with Windows Server 2008, the time to open the connection might be slow and take up to several minutes.

Miscellaneous

• Issue

  When detections occur on 64-bit systems, event notifications might fail. See the activity log and the on-access scanner messages dialog box for information about detections.

• Issue

  Some customers have reported seeing VirusScan Statistics (VShield) crashing or disappearing from the system tray. See McAfee Support KnowledgeBase article 613892 for more information about this issue.

• Issue

  The McAfee email scanner for Lotus Notes does not use the Quarantine Manager to quarantine detected threats. Consequently, if you configured the email scanner first action to Clean attachments or Delete attachments, the original version of the detected threat is no longer available for recovery or restore after the clean or delete action is taken on the detection. If you want the original version of the detected threat to be available after the action is taken on the detection, we recommend that you set the first action to Move attachments to a folder and specify a quarantine folder. When this move action is enabled, the original detected threat is moved to the specified quarantine folder with the .VIR extension appended to the detection.

  NOTE: If you enable the Move attachments to a folder option on client systems you should always have the on-access scanner enabled so those files may not inadvertently be accessed by a user.

• Issue

  When running VirusScan Enterprise 8.7i on a system with Microsoft Windows Server 2008, the on-access scanner might fail to delete a detected file from a network shared folder. The on-access scanner’s ability to delete a detected file is not guaranteed on network file systems. In this case, if the detected file is not deleted, the file content is removed and the remaining file size is zero.