Topic: What is so good about McAfee VSE ?

[haz]

Hello,
I use McAfee ePO 4.0 & VSE 8.5i to protect the network PCs -It wasn't me who chose to use it, its just the policy of the Mother Company- anyway; what is so good about McAfee ? Frankly (after about 1.5 years of deployment) I feel its not good enough, it happened several times that a PC is infected with a virus and McAfee (which is installed of course) doesnt detect it, I even had once to uninstall it, install a trial copy of kaspersky, remove the virus then reinstall McAfee after the trial period is finished ! I understand that no Anti-Virus is capable of detecting all the viruses out there, but still I believe it should do better for an "Enterprise" virus scanner.
So, Am I missing something ? is there a specific config that should be done ? I always use the "standard protection" while installing to allow the users to install / remove software without calling me every time ! 
What do you think McAfee users?

[Samker]

McAfee VirusScan Enterprise is an innovative technology for PCs and servers. It proactively stops and removes malicious software, extends coverage against new security risks, and reduces the cost of responding to outbreaks. Enterprises cannot afford to wait for every threat to be identified and a signature file to be released. The time between attack and subsequent identification is critical, and the shorter, the better. It's better yet if your protection technology identifies new, unknown threats.

By blending advanced anti-virus, firewall, and intrusion prevention technologies, VirusScan Enterprise covers a broad range of threats. With advanced heuristics and generic detection it finds even new, unknown viruses, even hidden in compressed files. McAfee VirusScan Enterprise looks for exploits known to target Microsoft applications and services and will identify and block threats that take advantage of JavaScript and VisualBasic coding.

And since virus protection is only as good as its latest update, the McAfee VirusScan Enterprise database is updated daily with information from McAfee Avert® Labs, one of the world's top threat research center.


I was copy this from here: http://www.mcafee.com/us/enterprise/products/system_security/servers/virusscan_enterprise.html and (what's more important) I can confirm this from my own experience.
I'm using VSE in combination with (old-good) McAfee Desktop Firewall for a years without any big problem, of course time to time I was experience some problem but almost all of them are caused if user doesn't care where they surf, if he look for some cracks, serials... and by mistake install some malware.

it happened several times that a PC is infected with a virus and McAfee (which is installed of course) doesnt detect it, I even had once to uninstall it, install a trial copy of kaspersky, remove the virus then reinstall McAfee after the trial period is finished ! I understand that no Anti-Virus is capable of detecting all the viruses out there, but still I believe it should do better for an "Enterprise" virus scanner.

Yes you got a right "no Anti-Virus is capable of detecting all the viruses out there" but in your place I'll rather try to make some investigation... which type of malware McAfee doesn't detect and how that malware get-in and spread across of your Company network?? Maybe you find some small "hole" in your protection or some user which cause all mess.
Of course every time when you find something bad and new, submit sample to to McAfee Labs : http://vil.nai.com/vil/submit-sample.aspx

is there a specific config that should be done ?

If you want I'll help you with my suggestions, but please first think about reasons for network infection and if you still have data give me names of malwares which McAfee doesn't detect in specific situations...


P.S.

So sorry for my bad English.

[haz]

Thanks a lot Samker for your reply, I like the way McAfee manages the updates, its easy and smooth, also it did well detecting Conficker and preventing it from running before it was even known by preventing Buffer overflow the virus kept trying to do, but as I said, its those incidents when it was there on the machine but it couldnt detect the virus, this particular virus I mentioned ( the one I used kaspersky for ) came when one of the users downloaded a malicious file sent to him by messenger ( a user mistake ), but how can I pinpoint the infected files to send it to McAfee Labs ? I mean provided that the original downloaded file was deleted by the user ? the virus just spreads in the PC ! but I will keep a log of the detected malware to ask you about it.
If you can help me with any suggestions or "best practices" for deploying McAfee in the network i would be grateful
Thanks again
 

[Samker]

...users downloaded a malicious file sent to him by messenger ( a user mistake ), but how can I pinpoint the infected files...
...if you can help me with any suggestions or "best practices" for deploying McAfee in the network...

Most Messengers have possibility to scan downloaded files, for example in MSN that option is under Files Transfer / "scan files for viruses using" / for McAfee VSE you need to Browse this file: "C:\Program Files\McAfee\VirusScan Enterprise\scan32.exe".

Second thing (more important) is to turn-on Heuristic Scan and Scan for Compressed files:




Next useful option is Unwanted Program Policy (turn-on all of them):




And for the end, you can configure additional protection by Access Protection Properties. This one is especially useful "Prevent termination of McAfee processes" under Common Standard Protection.




Hope this will help you?

Do you have some additional question or anything else what I can do to help?

Best Regards,

S.


P.S.

For correct view of inserted screenshots, make a right click with mouse on every of them and choose "View Image" option.
 

[fotis100]

thank you very much for all informations

[tuyugi007]

thx you very much i use mcafee

[haz]

WOW ! I didnt know about these before ! Thanks a lot Samker
I think I can add these setting from the ePO Server without having to adjust them on every machine, right ? that will be very handy Thanks again

[Samker]

I think I can add these setting from the ePO Server without having to adjust them on every machine, right ?

You'll set this easy.

cya around SCF,

S.

[sdwgnr76]

thank you. this program good.

[cbdenver]

How can you force custom settings from client machine, and not let EPO override them every time it checks for policies?

Thanks.