Installation guide

ManualsBrandsMcAfee ManualsHome building and DecorVIRUSSCAN ENTERPRISE 8.7I PATCH 4 - S

Release Notes

McAfee VirusScan Enterprise 8.8.0 Patch 4 Software

•

About this release

•

New features

◦ New features — Windows 8 and Server 2012 systems

◦ New features — other supported Windows systems

•

Resolved issues

◦ Issues resolved in this release

◦ Issues resolved in Patch 3

◦ Issues resolved in Patch 2

◦ Issues resolved in Patch 1

•

Installation instructions

◦ Requirements

◦ Install the product

◦ Verify the client installation

◦ File inventory

◦ Remove installation files

•

Known issues

•

Find product documentation

About this release

Thank you for using this McAfee product. This document contains important information about the current release. We

strongly recommend that you read the entire document.

Purpose

This release of McAfee

VirusScan

Enterprise 8.8.0 contains a variety of improvements and fixes.

Although McAfee has thoroughly tested this release, we strongly recommend that you verify this update in test and pilot

groups prior to mass deployment. Review the New features, Resolved issues, and Known issues sections for additional

information.

Important

Patch 4 is the last release of VirusScan Enterprise 8.8 to support Windows 2000.

For a list of supported environments and latest information for VirusScan Enterprise 8.8.0 on Microsoft Windows, see

KnowledgeBase article

KB51111.

Patch version

•

Patch 4 package — Updates VirusScan Enterprise 8.8.0 clients, with Patch 1 (32-bit) or Patch 2 (64-bit) only.

Important

This package does not upgrade VirusScan Enterprise version 8.8.0.777 (RTW).

To update with the Patch 4 package:

◦ On 64-bit systems, first install Patch 2, then Patch 4.

◦ On 32-bit systems, first install Patch 1, then Patch 4.

Alternatively, uninstall VirusScan Enterprise 8.8.0 and reinstall with the Repost

Summary of content (19 pages)

PAGE 1
Release Notes McAfee VirusScan Enterprise 8.8.
PAGE 2
Patch 4 package. • Repost Patch 4 package for Windows — Includes full installation for new systems or VirusScan Enterprise 8.7i systems. • Both the Patch and Repost packages include management packages for ePolicy Orchestrator: ◦ ◦ Patch Extension for VirusScan Enterprise VIRUSCAN8800(368).zip Patch Reports for VirusScan Enterprise VIRUSCANREPORTS120(236).zip Refer to KnowledgeBase article KB51111 for the most current VirusScan Enterprise 8.8.0 details.
PAGE 3
New properties in the ePolicy Orchestrator Query Builder. Feature Group Result Type Property (Column) System Management Managed Systems VirusScan Enterprise - Additional Properties | AP Enabled State VirusScan Enterprise - Additional Properties | OAS Enabled State To run an ePolicy Orchestrator report that lists the Access Protection and On-Access Scan status on VirusScan Enterprise client systems: 1 In ePolicy Orchestrator, select Queries & Reports. 2 Click the Query tab, then click New.
PAGE 4
• Warns when the number of characters in the field is within 200 characters of the maximum character limit. • Prevents these fields from exceeding the maximum character limit. ScriptScan browser support ScriptScan now supports: • Internet Explorer 10 • Internet Explorer 11 Note Note With Internet Explorer 11, Enhanced Protection Mode (EPM) might display an erroneous error message that ScriptProxy is disabled. However, ScriptScan is still scanning.
PAGE 5
option is selected, any missed ODS scans run immediately when the system wakes from suspended mode. • User present mode When a user is present (keyboard and/or mouse interaction within 5 minutes), VirusScan Enterprise performs any ondemand scans and DAT updates as specified by the schedule. Policy settings changes New or changed setting Console option Extension option Cookie scans have been removed.
PAGE 6
Delayed Write Scan mode is now enabled by default. This mode delays all scans of modified files to lower priority background threads. This improves performance for processes that write data to disk frequently and/or write a lot of data in a short amount of time.
PAGE 7
are hashed. To specify the size of files that trigger this behavior, set the DWORD value. ASLR and DEP features This release of VirusScan Enterprise enables the following security features for all VirusScan Enterprise components: • Address Space Layout Randomization (ASLR) • Data Execution Prevention (DEP) Resolved issues Here is a list of issues from previous releases of the software that have been fixed.
PAGE 8
usage for entire scan. 9 Issue — The Help File provided with VirusScan Enterprise 8.8 Patch 2 was incorrect and did not include all languages. (Reference: 826008) Resolution — This patch includes the correct help file with correct localization support. 10 Issue — On-Demand Scan exclusions were not properly excluded during scans. (Reference: 826029) Resolution — Fixed the path comparison when the exclusion list includes items in a combination of file names with no extensions, path names, and wildcards.
PAGE 9
20 Issue — In Metro mode, ScriptScan fails to load and execute. WWAHost.exe, which hosts and executes Metro Apps that use Java scripts, loads DLLs only from the system folder or apps package folder. ScriptScan resides in %program files%\systemcore folder. (Reference: 898855) Resolution — Added proper access rights to ScriptScan so that WWAHost.exe can load it.
PAGE 10
Patch 1 Issue — Third-party products that inject DLLs into processes could cause the VirusScan Enterprise service (VsTskMgr.exe) to periodically poll data and frequently log event 516 entries. (Reference: 625756) Resolution — The VirusScan Enterprise Task Manager service no longer causes prolific generation of the event 516.
PAGE 11
Resolution — VirusScan Enterprise now recompiles rules from a separate thread to resolve the underlying dead-lock condition. 12 Issue — The Lotus Notes scan driver did not support the new multi-threaded Lotus Notes Client version 8.0 and later. (Reference: 708485) Resolution — The Lotus Notes scan driver code now allows processing in multi-threaded Lotus Notes Clients version 8.0 and later.
PAGE 12
22 Issue — A STOP error (Bugcheck 7E) occurs due to a race condition between internal interface registration and deregistration. (Reference: 735108) Resolution — Simplified internal synchronization to avoid a registration race condition. 23 Issue — A STOP error (Bugcheck D5 or C2) would occur from a race condition caused by corruption in the kernel pool when attempting to free a buffer that had already been freed.
PAGE 13
1 Issue — The uninstall scripts do not detect the latest version of AV Kaspersky 6.0.4 when installing VirusScan Enterprise. (Reference: 701815) Resolution — When installing VirusScan Enterprise, the uninstall scripts now detects and removes AV Kaspersky 6.0.4. 2 Issue — The REBOOT=A option to SetupVSE.exe did not reboot the system if launched from a scheduled task. (Reference: 717989) Resolution — SetupVSE.exe now enforces the REBOOT=A option, even if the user is not logged on interactively.
PAGE 14
configured to reside on remote storage. (Reference: 660014, 663389, 665822, 667934) Resolution — The exception is handled to avoid a system crash. 8 Issue — Access Protection rules involving the block of System:Remote fail to enforce. This also applies to preventing remote access to shares. (Reference: 661424) Resolution — VirusScan Enterprise identifies remote share access and enforces Access Protection rules that prevent remote access to shares.
PAGE 15
18 Issue — An issue in the clean-file scan cache logic was identified on systems supporting the Server Message Block 2 (SMB2) protocol that could allow files to be written to a share and not be scanned. (Reference: 686645, 686650, 690277) Resolution — When On-Access Scanner tries to scan a share file and the scan does not succeed, the scanner now returns an OPLOCK error to McShield.
PAGE 16
Alternatively, uninstall VirusScan Enterprise 8.8.0 and reinstall with the Repost Patch 4 package. Repost Patch 4 New system installations VirusScan Enterprise 8.7i systems Minimum versions This release supports the following minimum versions. • Scan Engine: 5600 • Detection Definitions (DAT): 7000+ • McAfee Agent: ◦ ◦ ◦ 4.8.0.641 4.6.0.2288 4.5.0.1810 Install the product Install this patch directly to a target client system or use ePolicy Orchestrator to deploy this release to managed systems.
PAGE 17
Reboot the client system prior to validating that the installation is successfully installed. Task • Check any of the following items: • After the ePolicy Orchestrator agent collects property information, the client system details display the HotFix/Patch version. • On the client system, check for a registry key entry Patch_4 in HKey_Local_Machine\Software\McAfee\DesktopProtection.
PAGE 18
mferkdet.sys 15.1.0.656 OtlkScan.dll 15.1.0.543 shstat.exe 8.8.0.1247 mfetdi2k.sys 15.1.0.656 OtlkUI.xxx.dll 15.1.0.543 shutil.dll 8.8.0.1247 mfevtpa.dll 15.1.0.656 scriptff.dll 15.1.0.543 vsodscpl.dll 8.8.0.1247 mfewfpk.sys 15.1.0.656 scriptsn.xxx.dll 15.1.0.543 vsplugin.dll 8.8.0.1247 mscan32.dll 5.600.0.1067 RkScan.dll 1.0.0.231 VsTskMgr.exe 8.8.0.1247 Mscan64a.dll 5.600.0.1067 VSCAN.BOF 659 wscavexe.exe 8.8.0.1247 wscav.dll 8.8.0.
PAGE 19
McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others.