VirusScan 8.0i

I just loaded this thing about a minute ago, and was intrigued by the dialog telling me that it can't enable my NIC card without a reboot. Why? Port blocking, infection tracing and a host of others. Hmmm. Then I opened the console and smiled at the options at my disposal. I am not writing a review, nor did I search for a post because I have to get back and play now. I wanted to post a jpg, since I am in shock that McAfee actually made some progress this time around... not just another engine tweak.

Here is a screen shot.

Yeah, I saw somewhere else about 8.0I having buffer overflow protection. We use McAfee at work so I'm gonna see if we can get the upgrade.

Hey why dont you test the protections out and let us know how it went? Care to be our ginnea pig?

We use McAfee as well, but I have not deployed VirusScan 8.0 to any of my clients at this point. Heck, I've not even had a chance to really play with it myself, so I can't very well distribute it around yet. I did install it on my machine when it was first released (been several months now), but never had time to mess and simply went back to the version everyone else is on.

I'd be interested to hear what all you find about 8.0 - hopefully I'll have some time soon to dive into it as well..

why though does scan32.exe, even with 8.0i and e-policy orchestrator take up all the processing power when it runs. besides framework services and mcshield, when scan32.exe gets going, i might as well just make a couple of cups of coffee, throw my feet up and watch the ladies out my office window ...... i dont mind this part, but damn its a resource hog ..............? if any of you guys can help, till be great ..... hate my screen freezing, oh, stinger runs in tandem with scan32..... the av guys did this ....... we cannot set the start or end times for the scan ....

pentium4
512 mb ram
2 x 40 gb hdd
some el-cheapo graphic card
windows xp pro
page file : 880 - 1024
loads of space left on both drives.

My initial observation is that it actually loads faster than 7.x I do some benchmarking on other machines. I haven't delployed it yet either, it was actually released in Sept. and I am just now getting it up for a look. Later today I will test the "unwanted program" feature by enabling spyware and malware blocking. That alone would be very nice because the setting would be tweakable via Epolicy Orchestrator at the Enterprise level.

One thing that could slow down systems is the ability to monitor ALL vb and scripting code. Not just in email. Whenever the scripting engine is called into play 8.0i will (supposedly) monitor for a host of known exploits.

My experiences w/ VS8.0i are mixed, mostly due to the overwhelming let down of the integrated anti-spyware/adware module as a vialbe solution. Overall, I do like the newest version but sometimes I long for the 7.x days...and I innately don't care for "do-it-all-in-one-box" solutions - too much centralized risk and not enough cyber-diversity for my taste.

The Unwanted Programs detection is seriously lacking...in fact, lacking so hard that Network Associated is (has) released an add-on module for VS8.0i and VS7.1 which...hold your breath....is an anti-spyware/adware engine. And to boot, they're going to charge for it. What a jip methinks. moreover, at least for me and my colleagues, the lackluster performance of VS8.0i's spyware/adware engine places suspicion on the whole product's effectiveness.

On the other hand, I completely love ePolicy Orchestrator. I've started with ePO from version 1.0 and have been with the product ever since. It has come a long way and I don't think my anti-malware infrastructure would be so strong w/out it.

Anyway, I thought the original posters to this thread would find it interested that even NAI admits that VS8.0i isn't living up to their exhortations and will (have) release an add-on module (for which they'll be charging) to compensate.

CHeers,
<0

lessthanzero: Thanks a bunch for the good info. My biggest concern is this is version 1.0 of a new feature-set and we all know 1.0 of anything can be buggy (to put it kindly). That coupled with NA's poor track record, IMO, with their software (re.; problematic installs, performance problems, etc) with both McAFee and EPO...and well I'm very skeptical and cautious.

My company plans to start testing this new version in the coming month so we'll see.

Thanks again. Happy new year!

@ric-o

Are you using ePO to manage your AV deployment and subsequent updates (both DAT, engine, and component)? If not, NAI has two other options:

1. Protection Pilot - think of this as a mini-ePolicy Orchestrator. It has a limit of how many clients it can manage (500 if I recall correctly) but centralizes deployment and post-deployment management. It uses the same CMA (Agent) that ePO uses, so it provides a nice migration path to full ePO should the organization require scalability.

2. VirusScan ASaP - outsourced AV management. I don't have any experience with this product, so my comments are pure opinion/speculation. I would think this could have a good ROI if you are a single, part-time administrator of a small-to-medium sized operation.

Though my experience with the native anti-spyware/adware component of VS8.0i has been, well bad, I haven't experienced any serious problems with the rest of the product. I have to say; a lot of headaches are prevented/minimized via the centralized power of ePO. Deployment issues are very minimal and those that do arise are (normally) very easily corrected via the central console.

Just keep in mind the VS8.0i is vastly different than VS7.1. There are dozens upon dozens of new possible configuration settings with 8.0i which can/will affect your environment negatively if you don't prototype correctly and plan ahead. I highly recommend a slow, phased rollout. Meaning, get all machines on VS8.0i but with only the anti-viral components enabled (mirror your VS7.x policy). Then, slowly enabled the new componets one at a time across all of the departments/branches.

Of course, prototyping the product in a lab setup (personally, I use VMWare - lucky enough to have a machine which can spawn more than 5 virtuals at once) will save you a lot of pain in the long run. You'll have an good idea of how the various VS8.0i components can interact with other software. You'll also have a good idea of how to deal with issues during deployment.

Anyway, don't hesitate to PM or email me if you have any questions about ePO and/or VS8.0i. I'd be glad to help if possible. Also, check out this unofficial McAfee forum...some good info is posted there:

http://forums.mcafeehelp.com/

Cheers,
<0

Quote:

---

I thought the original posters to this thread would find it interested that even NAI admits that VS8.0i

---

Thanks for the Update! Right after posting this I was handed three projects to be completed by the end of the year. 3 new websites with interfaces to a centralized imaging component and a new industrial type rollout on a high-speed imager. Whew. Had to cancel my Christmas vacation and all that but I got it done and I am going to friggin party on New Years. However; VS 8 is on the back burner going into the New Year. And your post gives me even more justification to not take advantage of the Malware/Unwanted programs features right away like I intended and a new project is heading my way. It made it onto 3 machines with no issues. XP fire walling is causing me loss of sleep but VS did ok so far.

As an old hat ePO user, I downscaled my latest contract to the Protection Pilot arrangement because it is a lot cheaper. Although less robust it easier to use and I don't have to spend as much time with it and it still does what I need it to do. I use the same agents that I deployed with ePO about 2 or 3 years ago. Either option is a great tool to keep compliance in check.

//Edit lol, got this when I clicked the Mcafee help link...


phpBB : Critical Error

Error creating new session

DEBUG MODE

SQL Error : 1114 The table 'phpbb_sessions' is full

INSERT INTO phpbb_sessions (session_id, session_user_id, session_start, session_time, session_ip, session_page, session_logged_in) VALUES ('226383140d0c062a5155ee6e763bfa5a', -1, 1104428541, 1104428541, 'cfe11be5', 0, 0)

Line : 158
File : /var/www/localhost/htdocs/phpBB2/includes/sessions.php


Hey Mcafee read this

i dont see how or why ur computers are slowing down soo bad with running the virus scanning or the mcshield... im on xp pro with a 766 mhz cpu and 128 ram on 30 gb hd and never had a problem... ive been using mcafee for several years now and i really like the 8.0i version with how much they advanced all the security settings to it and cant wait to try the new 9.0 version when i get the updated copy of it... after u completely set up ur security settings to the highest scanning possible and set that as ur default and restart ur comp to make it run at that the whole time u use this program u shouldnt have any problems... if its slowing ur comp down while doing virus scans then i would suggest after u download the updates and restart ur comp, make sure u shut down ur internet connection or disable it if ur on a lan connection and shut down any programs that are running that could cause it to slow down until the scan is done... after the scan is done then turn back on ur lan connection to the web and restart ur cmp... if that doesnt help then u seriously need to clean up unwanted programs, files, and folders not needed, disk scan, and disk defrag the comp so it runs faster... with as old and slow as my comp can be ive found it running twice as fast with mcafee running then if i didnt have it at all... so hopefully u can find things to do to help speed up the performance of the pc's ur working on