# Release Notes for McAfee® VirusScan® Enterprise 8.8

- About this document
- New features
- Known issues
- Where to find McAfee enterprise product information
- License attributions

## About this document

Thank you for using VirusScan Enterprise software. This document contains important information about this release. We strongly recommend that you read the entire document.

CAUTION: We do not support automatic upgrading of a pre-release version of the software. To upgrade to a production release of the software, you must first uninstall the existing version of the software.

The VirusScan Enterprise 8.8 release uses the following:

- Engine version: 5400.1158
- Detection definition (DAT): This version of VirusScan Enterprise software automatically downloads the latest version of the DAT files when the software is installed. Previously the DAT files were included in the installation executable.

## New features

New and updated features in the VirusScan Enterprise 8.8 software release.

## Performance improvements

This release reduces:

- On-access scan time
- On-demand scan time
- System startup time

Caches previously scanned files in a common location to reduce duplicate file scanning and improve performance.

## Windows Office 2010 support

This release supports all Windows Office 2010 applications, specifically adding on-access scanning of Microsoft Outlook 2010 email and attachment files.

## ScriptScan exclusion support

ScriptScan exclusions, URLs of trusted scripts from known safe websites, can be easily added to reduce scanning and improve performance. This feature is available in ePolicy Orchestrator 4.0 or later, and in the VirusScan Console. Previously these excluded URLs required manual registry editing.

## Known issues

Known issues in this release of the software are described below.

- Migrating policies and events in ePolicy Orchestrator
- Supported platforms and products
- Compatibility with other products
- Updating
- Remote console
- Miscellaneous
- Documentation

## Migrating policies and events in ePolicy Orchestrator

- Issue

  The ePolicy Orchestrator Migration tool might fail to migrate the existing policies and tasks from an ePolicy Orchestrator Server that uses Windows NT authentication for ePolicy Orchestrator access. In some cases the ePolicy Orchestrator Migration tool needs to pass the SQL administrator password as a parameter for the ePolicy Orchestrator Migration tool.

  Workaround: Run the ePOPolicyMigration.exe command from the command line, and add the /PASSWORD switch and the SQL administrator password. For example, type: [path]\epopolicymigration.exe /password=sql_admin_password

  For information about using the ePolicy Orchestrator /PASSWORD switch at the command line see the McAfee VirusScan Enterprise 8.8.0 Installation Guide. (611047)

## Supported platforms and products

- This version of VirusScan Enterprise supports Lotus Notes version 7.0.x and 8.0.x – 8.5.1. See the VirusScan Enterprise 8.8 Installation Guide for information about supported applications.

## Compatibility with other products

- Issue

  After successfully upgrading from VirusScan Enterprise 8.7 to VirusScan Enterprise 8.8 the ePolicy Orchestrator 4.5 System Details dialog box does not list VirusScan Enterprise 8.8 in the Installed Products row. (620509)

- Issue
  After installing VirusScan Enterprise 8.8 on a system where McAfee Network Access Control 3.0 is installed, a failure might occur that prevents identification of McAfee services. You might see these symptoms:
  - A specified driver is invalid message is logged if you perform an update task before restarting.
  - A driver failed to load message is logged for one or both products.
  - The local system application event log contains event ID 5004.

  Workaround: Uninstall the failed product, restart the system, then reinstall the product.

- Issue

  NVIDIA® drivers might cause performance issues or system failure. VirusScan Enterprise 8.8 might run at 100% CPU utilization or cause the system to fail. See KnowledgeBase articles KB51688 and KB52367 for more information about this issue. (388060)

- Issue

  Running the VirusScan Enterprise 8.8 installer fails to completely remove all the CA Anti-Virus version 7.0 and 7.1 program directory structure and registry key entries.

  Workaround: None. This is an issue with the CA Anti-Virus uninstall program. (625703)

- Issue

  On standalone client systems, VirusScan Enterprise 8.8 fails to complete the initial product update with Panda Anti-Virus 2008 also installed.

  When you run `VSESetup.exe` and selected the option No, to not remove the Panda Anti-Virus 2008 software, at the last stage where VirusScan Enterprise 8.8 would perform the product update, the update dialog box might hang for 20 minutes or more.

  Workaround: When you run VSESetup.exe, selected the option Yes to remove the Panda Anti-Virus 2008 software. (626009)

- Issue

  On an ePolicy Orchestrator managed client, if you run `VSESetup.exe` and select the option to remove detected anti-virus software, some Symantec anti-virus files, directories, and registry keys are left on the system.

  Workaround: None. (629265)

- Issue

  Upgrading from VirusScan Enterprise 8.7i to VirusScan Enterprise 8.8 via ePolicy Orchestrator might cause the MSI installer (`msiexec.exe`) to trigger the Access Protection rule Common Standard Protection: Prevent termination of McAfee processes.

  Workaround: None. This does not affect the installation and can be ignored. (635226)

## Updating

- Issue
  The update log might report an “Update failed” and not indicate any other error. The update function for patches, DATs, and engines requires enough free space and memory to expand the upgrade packages. You must have the following minimum space requirements for a successful update:
  - 125MB of free hard disk space
  - 250MB of total free hard disk and memory space
    NOTE: Windows virtual memory can also be used to create additional memory space, but that total must equal 250MB of free space.

  This hard disk and memory requirement is particularly important for embedded and virtual systems where running the minimum system requirements is often the case. (625749)

- Issue

  Failure to access the repository is not logged in the VirusScan Enterprise 8.8 update log, but is logged in the McAfee Agent log. The default location of the McAfee Agent log is: <drive>:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\mcscript.log. (384749)

- Issue

  Silent update tasks performed from the command line still display the progress dialog box. The installation completes successfully, but the Update in progress dialog box appears when you run `setup.exe /q RUNAUTOUPDATESILENTLY=TRUE` from the command line. (399265)

- Issue

  When you run the command `setup.exe CMASOURCEDIR="<drive>:\Documents and Settings\<username>\Desktop\"` from the command line to install the product and import the Sitelist.xml file from the Desktop, the installation successfully completes, but fails to import the Sitelist.xml file.

  Workaround: Use a Sitelist.xml file that was created by ePolicy Orchestrator agent 4.0. If the McAfee Agent 4.0 installation upgraded a previous installation of ePolicy Orchestrator agent 3.6.1, it produces a correct Sitelist.xml file that can be imported. (419467)

## Remote console

- Issue

  When using the Remote Console feature to connect to Windows Vista systems or later, you are unable to open Access Protection, Buffer Overflow, and Quarantine Manager dialog boxes for the remote systems and no error appears. This is because the Windows Vista and later systems do not automatically start the Remote Registry service required by the Remote Console feature.

  Workaround: Before starting the Remote Console feature, manually start the Remote Registry service on the remote system using the following:
  - Click Start | Run and type `services.msc`. The Services dialog box appears.
  - Right-click Remote Registry, in the Services (Local) | Name column, and click Start.
  (581439)
- Issue

  When using the Remote Console feature to open Access Protection properties on a system with Windows Server 2008, it might take several minute to open the connection. (392825)

## Miscellaneous

- Issue
  Buffer overflow protection appears disabled in the console when you restart the mcshield.exe service from the command line. For example, if you disable access protection and on-access scanning then, from the command line, stop and restart the mcshield service the Buffer Overflow Protection task appears disabled in the console.
  NOTE: Buffer overflow protection is actually enabled and functioning correctly.

  Workaround: Use these steps to restart the McAfee Task Manager service and reset the appearance of the Buffer Overflow Protection task status:

  1. Close the VirusScan Enterprise 8.8 console.
  2. Click Programs | Administrative tools | Component Services to open the Component Service dialog box.
  3. In the Services list, select the McAfee Task Manager and click Restart.

  When you reopen the VirusScan Enterprise 8.8 console, the Buffer Overflow Protection status appears enabled. (638390)

- Issue

  When you try to move an infected file from one folder to another, within the same volume, the configured actions for "When a threat is found" are not performed on the source file, but the move is prevented. This is expected behavior for VirusScan Enterprise 8.8. For detailed information, see KnowledgeBase article KB70468. (633871)

- Issue

  If you run an on-demand scan from Microsoft Outlook 2010 and an email with malware is detected in the body of a message, the Junk E-mail Filter moves the message to the Junk E-mail folder. This is not expected behavior. The infected message should have been moved to the Quarantine folder.

  Workaround: None. This is caused by the Junk E-mail Filter in Microsoft Outlook 2010. (631700)

- Issue

  When you run the CheckPoint pireg.exe utility the following error message appears:

  `mcavscv.dll does not exist`

  Workaround: To stop this error from appearing, install the Microsoft Visual C++ 2008 Redistributable Package. (629324)

- Issue

  In the User Account Control (UAC) window prompt if you make certain setting changes and click No the changes are still made. This issue only affects the following systems using Microsoft Outlook 2010:

  - Microsoft Windows 7 or Microsoft Windows Server 2008 (32-bit or 64-bit) systems
  - Systems with UAC enabled

  Specifically, in these environments:

  1. If you open the On-Demand Email Scan properties from Microsoft Outlook 2010, change the Reports tab settings from the default to any other setting, for example enable Session settings, and click Apply or OK.
  2. When the Windows UAC window prompts you, `Do you want to allow the following program to make changes to this computer?`, even if you click No, to disregard the change, the change is made.

  Workaround: None. This is a problem with the Windows UAC and there is no workaround. (627058)

- Issue

  Disabling on-access scanning does not disable ScriptScan. With VirusScan Enterprise 8.7 and earlier, if you disabled on-access scanning it would also disable the ScriptScan feature. With VirusScan Enterprise 8.8 if you disable on-access scanning ScriptScan continues to run.

  Workaround: Use one of these user interfaces to disable the VirusScan Enterprise 8.8 ScriptScan feature:
  - ePolicy Orchestrator 4.5 or 4.6
    1. Click Menu | Policy | Policy Catalog, then from the Product list select VirusScan Enterprise 8.8.0. The Category list displays the policy categories for VirusScan Enterprise 8.8.0.
    2. From the Category list, select the On-Access General Policies and from the Actions column, click Edit Setting to open the policy configuration page.
    3. From the Settings for list, select Workstation or Server.
    4. From the On-Access General Policies page, click the ScriptScan tab.
    5. Deselect the Enable scanning of scripts checkbox.
    6. Click Save to capture the configuration change.
  - ePolicy Orchestrator 4.0
    1. Click Systems | Policy Catalog, then from the Product list select VirusScan Enterprise 8.8.0. The Category list displays the policy categories for VirusScan Enterprise 8.8.0.
    2. From the Category list, select the On-Access General Policies and from the Actions column, click Edit Setting to open the policy configuration page.
    3. From the Settings for list, select Workstation or Server.
    4. From the On-Access General Policies page, click the ScriptScan tab.
    5. Deselect the Enable scanning of scripts checkbox.
    6. Click Save to capture the configuration change.
  - VirusScan Console
    1. From the Task list, right-click On-Access Scanner, then click Properties to open the dialog box.
    2. From the On-Access Scan Properties page, click General Settings, in the left-hand pane, and click the ScriptScan tab.
    3. Deselect the Enable scanning of scripts checkbox.
    4. Click OK to capture the configuration change.
- Issue

  Using Microsoft Outlook 2010, if you want to perform an on-demand scan on a selected folder only one item in the folder is scanned.

  NOTE: This issue does not occur with Microsoft Outlook 2007.

  Workaround: To perform an on-demand scan on an entire Microsoft Outlook 2010 folder:

  1. Select the name of the folder you want to scan.
  2. Open the folder and unselect the single item highlighted using Ctrl left-click on the item.
  3. Run the on-demand scan and all the items in the folder should be scanned.

  (624659)

- Issue

  With Microsoft Windows 2000 SP4, if you try to edit the AutoUpdate Repository list using the Tools | Edit AutoUpdate Repository List command in the VirusScan Console, the following error might appear:

  `Failed to read the repository list, Error = fffffffc`

  If the error appears it is because the `SiteList.xml` file is missing from the following path:

  `C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework`

  Workaround: Copy a `SiteList.xml` file from the McAfee Agent 4.0 installation package, or another location, to the path. (568699)

- Issue

  When you configure a drive to exclude from on-access scanning, use a UNC path, not a mapped network drive. For example, if you type `Z:`, for the mapped network drive in the Set Exclusions dialog box, the files in the mapped drive are not excluded from on-access scanning.

  Workaround: To exclude a network drive from on-access scanning use a UNC path, not a mapped network drive. (546966)

- Issue
  Using the extended character set when adding Default + additional file types does not work as you expect when configuring either On-Delivery Email Scan Properties or Outlook On-Demand Scan. For example, if you add the file type `ÃbÃ` to the User-specified additional file types to scan, you only expect scanning of the "xxxxx.ÃbÃ" file. But, both of the following files are scanned:
  - xxxxx.ÃbÃ
  - yyyyy.Ãbc
  This is expected behavior when using the extended character set.
  NOTE: This only occurs on some Windows 64-bit systems using Windows Outlook 2010 x64 Professional Edition.

  To scan only the file type `ÃbÃ`, configure an exclusion using the wildcard characters `?` or `*`. For example, configure an exclusion using `Ãb?` or `Ã*`.

  (586207)

- Issue

  The McAfee email scanner for Lotus Notes does not use the Quarantine Manager to quarantine detected threats. Consequently, if you configure the email scanner's first action as Clean attachments or Delete attachments, the original version of the detected threat is no longer available for recovery or restoration. If you want the original version of the detected threat to be available after the action is taken on the detection, McAfee recommends setting the first action as Move attachments to a folder and to specify a quarantine folder. When this move action is enabled, the original detected threat is moved to the specified quarantine folder with the .MCM extension appended to the detection.

  If you enable the Move attachments to a folder option on client systems you should always have the on-access scanner enabled so those files can not inadvertently be accessed by a user. (430862)

- Issue

  When running VirusScan Enterprise 8.8 on a system with Microsoft Windows Server 2008, the on-access scanner might fail to delete a detected file from a network shared folder. The on-access scanner’s ability to delete a detected file is not guaranteed on network file systems. In this case, if the detected file is not deleted, the file content is removed and the remaining file size is zero. (431158)

## Documentation

- Issue

  After localization of the McAfee VirusScan Enterprise 8.8 software Installation Guide, the information in the System requirements section was changed. The English language files include this change.

  In Table 1: Minimum workstation requirements, the minimum RAM and processor requirements were changed in the following rows (changes shown as Bold text):

  Table 1. Minimum workstation requirements
  Operating system | SP | 32-bit | 64-bit | Processor | RAM | Minimum hard disk space
  --- | --- | --- | --- | --- | --- | ---
  Microsoft Windows 2000 Professional, with Update Rollup 1* | SP4 | X |  | 133 MHz or greater Pentium. Up to two processors on a single computer | 64 MB minimum and 4 GB maximum | 450 MB
  Microsoft Windows XP Home and Professional Editions | SP2 or SP3 | X |  | 233 MHz or greater (single or dual processor system), Intel Pentium/Celeron family, or AMD K6/Athlon/Duron family, or compatible | 256 MB | 450 MB
  Microsoft Windows XP Tablet PC Edition | SP3 |  |  | 233 MHz or greater | 256 MB** | 450 MB
  Microsoft Windows XP Embedded (2003) |  | X |  | 233 MHz or greater | 256 MB** | 450 MB
  Microsoft Windows Embedded Standard 2009 |  | X |  | 233 MHz or greater | 256 MB** | 450 MB
  Microsoft Windows POS 1.1 | SP3 |  |  | 233 MHz or greater | 256 MB** | 450 MB
  Microsoft Windows Point of Service (POS) Ready 2009 |  |  |  | 233 MHz or greater | 256 MB** | 450 MB
  * You must install McAfee Agent version 4.0 before installing this version of VirusScan Enterprise on Microsoft Windows 2000 Professional SP4 systems. ** At least 250 MB of free memory space must be available to update DAT and engine files. Windows virtual memory can also be used to create additional memory space.

  In Table 2: Minimum server requirements, the minimum RAM requirements were changed in the following row (change shown as Bold text):

  Table 2. Minimum server requirements
  Operating system | SP | 32-bit | 64-bit | Processor | RAM | Hard disk space
  --- | --- | --- | --- | --- | --- | ---
  Microsoft Windows 2000 Server, Advanced Server, and DataCenter Server editions, with Update Rollup 1* | SP4 | X |  | 133 MHz or higher Pentium. Maximum four processors on a single computer. | 256 MB minimum and 4 GB maximum | 450 MB
  * You must install McAfee Agent version 4.0 before installing this version of VirusScan Enterprise on Microsoft Windows 2000 Professional SP4 systems.

- Issue

  After localization of the McAfee VirusScan Enterprise 8.8 software Product Guide and Help, the information in the Configuring general settings section was changed. The English language files include this change.

  In each of the user interface consoles the following step has been modified to include a Note:

  On the ScriptScan tab, enable ScriptScan and specify any processes or URLs you want to exclude from scanning.
  NOTE: With previous versions of VirusScan Enterprise disabling on-access scanning disabled ScriptScan. With VirusScan Enterprise 8.8 disabling on-access scanning does not disable ScriptScan. To disable ScriptScan deselect the Enable scanning of scripts checkbox.
- Issue

  After localization of the McAfee VirusScan Enterprise 8.8 software Product Guide and Help, the information in the On-Access Scan Policies Help for the General tab was changed. The English language files include this change.

  The following information was added to the Scan option:

  Trusted installers —Specify if MSI files, installed by msiexec.exe and signed by McAfee or Microsoft, or if Windows Trusted Installer service files, are scanned on-access:
  - Disabled (default), do not scan files installed by MSI or Windows Trusted Installer service.
    NOTE: Disabled improves the performance of large Microsoft application installers.
  - Enabled, scan files installed by MSI or Windows Trusted Installer service.

## Where to find McAfee enterprise product information

The McAfee documentation is designed to provide you with the information you need during each phase of product implementation, from evaluating a new product to maintaining existing ones. Depending on the product, additional documents might be available. After a product is released additional information regarding the product is entered into the online Knowledgebase available on McAfee ServicePortal.

Installation Phase | Setup Phase | Maintenance Phase
--- | --- | ---
Before, during, and after installation. Release Notes Known issues in the current release. Issues resolved since the last release. Last-minute changes to the product or its documentation. Installation Guide Preparing for, installing and deploying software in a production environment. | Getting up-and-running with the product. Product Guide and Online Help Setting up and customizing the software for your environment. Online Help Managing and deploying products through ePolicy Orchestrator. Detailed information about options in the product. | Maintaining the software. Online Help Maintaining the software. Reference information. All information found in the product guide. Knowledgebase (knowledge.mcafee.com) Release notes and documentation. Supplemental product information. Workarounds to known issues.

### Finding release notes and documentation for McAfee enterprise products

Use this task to go to the release notes and other product documentation for McAfee enterprise products.

1. Go to knowledge.mcafee.com and select Product Documentation under Useful links.
2. Select <Product Name> | <Product Version> and select the required document from the list of documents.

## License attributions

COPYRIGHT

COPYRIGHT

Copyright © 2010 McAfee, Inc. All Rights Reserved.

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.

TRADEMARK ATTRIBUTIONS

TRADEMARK ATTRIBUTIONS

AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners.

LICENSE INFORMATION

LICENSE INFORMATION

License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.