# Release Notes for McAfee® VirusScan® Enterprise 8.7i - Beta 1

- Dat Version: 5265

- Engine Version: 5.2.00

Thank You For Using VirusScan Enterprise software. This Document Contains Important Information About This Release. We Strongly Recommend That You Read The Entire Document.

CAUTION: We Do Not Support Automatic Upgrading Of A Pre-release Version Of The Software. To Upgrade To A Production Release Of The Software, You Must First Uninstall The Existing Version Of The Software.

## Contents

- Beta product license
- New features
- Known issues
- Where to find McAfee enterprise product information

## Beta product license

The beta license for this product expires on June 15, 2008.

## New features

New and updated features in the current release of the software are described below:

- Performance improvements
- New email scanner
- Buffer overflow protection exclusions by API

### Performance improvements

- Improved local control of on-demand scans via battery state and full screen awareness and allowing end users to delay scheduled on-demand scan.
- Enhanced system throttling includes registry and memory scanning.

### New email scanner

Improves reliability with double-byte and multi-byte languages.

### Buffer overflow protection exclusions by API

The ability to specify buffer overflow exclusions by API was removed from VirusScan Enterprise 8.5i, but has been reinstated for the VirusScan Enterprise 8.7i release. The API exclusion name is case-sensitive.

## Known issues

Known issues in this release of the software are described below:

- Product Documentation
- Installation
- Supported Platforms and Products
- Compatibility With Other Products
- Updating
- Buffer Overflow Protection
- Email Scanning
- Miscellaneous

### Product Documentation

- Issue

  Product documentation. The preliminary versions of the release notes, product guide, and installation guide are available for download from the McAfee beta website under the VSE product “Documentation” tab. The online help is not available for this beta release of the product. Refer to the product guide for information about the product and configuring its options. This issue is expected to be fixed for the final release of the product.

### Installation

- Issue

  The 64-bit version of Panda Antivirus 2008 is not removed during the VirusScan Enterprise installation. During the VirusScan Enterprise stand-alone product installation, the user is notified to manually remove the product. During silent installation, such as deployment via ePolicy Orchestrator, the VirusScan Enterprise installation fails with no notification. In either case, the user must manually uninstall the 64-bit version of Panda Antivirus 2008, then reinstall VirusScan Enterprise.

- Issue

  VirusScan Enterprise 8.7i cannot be installed on a system where the VirusScan for NetApp 7.1 console is running. This issue is expected to be fixed before the final release of the product.

- Issue

  The Policy Migration tool is used to upgrade ePO managed versions of VSE polices and tasks from an earlier version of VSE to a later version. The Policy Migration tool only runs one time per server. If you have both the VSE8.0i .NAP file and the 8.5i .NAP or extension installed on the same server, you must choose whether to upgrade the VSE8.0i policies and tasks or upgrade the 8.5i policies and tasks. You cannot upgrade both. For example, if you use the migration tool to upgrade the VSE8.0i policies and tasks to VSE 8.7i, then you cannot upgrade the VSE 8.5i polices and tasks to VSE 8.7i and vice-versa.

  Note:

  You can upgrade more than one version of the VSE software to a later version in ePO, but you can only upgrade one version of the VSE policies and tasks to a later version.

  Choose only one of these options:

  - When upgrading VSE 8.5i policies and tasks in ePolicy Orchestrator 3.6.1, first check in the .NAP file, then execute the Policy Migration tool on the server.

  - When upgrading VSE 8.5i policies and tasks in ePolicy Orchestrator 4.0, first check in the extension, then execute the Policy Migration tool on the server.

  - When upgrading VSE 8.0i policies and tasks, use the command-line option with the force switch as follows: ePOPolicyMigration.exe /force80

- Issue

  Unable to start McShield after using custom installation to install VSE with the on-access scanner disabled. If you deselect the Enable On-Access Scanner at the end of installation option during a custom installation, then attempt to enable the on-access scanner from the VirusScan Console, McShield does not start. You must enable the on-access scanner twice to change the McShield service from Stopped to Started. The first attempt to enable the on-access scanner changes the McShield service to Paused and the second attempt changes the service to Started. This issue is expected to be fixed for the final release of the product.

### Supported Platforms and Products

This version of VirusScan Enterprise supports Lotus Notes version 6.0x, 6.5, and 7.0x.

Refer to the Installation Guide for information about supported operating systems.

### Compatibility With Other Products

- Issue

  NVIDIA® drivers may cause performance issues or system response failure. VirusScan Enterprise 8.7i may run at 100% CPU or cause the system to fail to respond when running on specified NVidia drivers. See Knowledge Base articles 614212 and 65066 for more information.

### Updating

- Issue

  The update task fails the first time after any system restart when running VirusScan Enterprise 8.7i on a system with Microsoft Windows 2000 Professional and Server operating systems. In this scenario, the update task fails the first time after every manual or scheduled system restart and may also be seen when a manual update is performed after the system is left running for days. Subsequent update tasks are successfully performed in either case. If an update task fails in this scenario, start another update task or wait for the next scheduled task to perform.

- Issue

  McShield may crash during an update task if the task is performed while McShield is disabled and there is a DAT change. The crash occurs for all update tasks; manual updates, scheduled updates, and rollback tasks unless the DAT is current on the system and/or McShield is running during the update task. This issue is expected to be fixed for the final release of the product.

### Buffer Overflow Protection

- Issue

  The list of basic Buffer Overflow Protection exclusions is cleared when accessing advanced exclusions after specifying basic exclusions. If you first specify basic exclusions, then select the option to specify advanced exclusions, the list of basic exclusions is cleared and the specified exclusions are lost. To prevent this, you must specify all basic and advanced exclusions in one list. This issue is expected to be fixed for the final release of the product.

- Issue

  Buffer overflow detections may not display the blocked Source IP and if the Source IP is displayed, the Unblock all connections now option is disabled. When this occurs, the system is protected as follows:

  The detection is recorded in the activity log.

  The Source IP may or may not be displayed in the on-access scan statistics dialog box.

  The share is blocked from the same access by a remote system whether the detection displays in the statistics dialog box or not.

  The block cannot be removed because the Unblock all connections now option is disabled.

  This issue is expected to be fixed for the final release of the product.

### Email Scanning

- Issue

  The Exchange server’s Store services crash when the on-delivery email scanner detects volumes of threats. When the Store services fail, mail is not processed for any client attached to the Exchange server. This issue has been seen in less than two hours when a single client has been running on-delivery email scan detections. This issue may also exist in the on-demand email scanner. The issue has not been seen when using the Lotus Notes email scanner. We strongly recommend that the Exchange server used for all email testing be included in the Beta lab environment, and not in a production environment. This issue is expected to be fixed for the final release of the product.

- Issue

  On-delivery email scanning may fail to end the scanning process at the end of the scan. If this occurs, manually stop the Microsoft Outlook client on the system. This issue is rare and may be sample specific. This issue is expected to be fixed for the final release of the product.

### Miscellaneous

- Issue

  The Extra.DAT version displays as “None” in the activity log. Although the Extra.DAT version does not display in the activity log, detections occur as expected. To view the Extra.DAT version, see the About dialog box or the ePO events. This issue is expected to be fixed for the final release of the product.

- Issue

  On-access scanning session settings are not recorded in the activity log even though the option was selected on the Reports tab. This issue is expected to be fixed for the final release of the product.

- Issue

  When you create scheduled tasks in VSE8.5i then upgrade to VSE 8.7i, the created tasks are available, but they do not run as scheduled. To correct this issue, restart the system after the upgrade. This issue is expected to be fixed for the final release of the product.

- Issue

  When detections occur on 64-bit systems, event notifications may fail. See the activity log and the on-access scanner messages dialog box for information about detections.

- Issue

  The first attempt to access a system with Windows 2000 operating system and VSE from a remote system fails. This issue only occurs on the first attempt to access the system after a system restart. Although the error message indicates there is a problem with the file format or syntax, the issue resolves itself in second and subsequent accesses.

- Issue

  A “Virtual Machine” access protection rule violation occurs when you log in to Windows XP, Service Pack 2 on a VMWare image. The rule that triggers this violation has been set to “Report” by default for this release. This issue is expected to be fixed for the final release of this product.

## Where to find McAfee enterprise product information

The McAfee documentation is designed to provide you with the information you need during each phase of product implementation, from evaluating a new product to maintaining existing ones. Depending on the product, additional documents might be available. After a product is released additional information regarding the product is entered into the online Knowledgebase available on McAfee ServicePortal.

Installation Phase | Setup Phase | Maintenance Phase
--- | --- | ---

Before, during, and after installation.

Release Notes

- Known issues in the current release.
- Issues resolved since the last release.
- Last-minute changes to the product or its documentation.

Installation Guide

- Preparing for, installing and deploying software in a production environment.

Getting up-and-running with the product.

Product Guide and Online Help

- Setting up and customizing the software for your environment.

Online Help

- Managing and deploying products through ePolicy Orchestrator.
- Detailed information about options in the product.

Maintaining the software.

Online Help

- Maintaining the software.
- Reference information.
- All information found in the product guide.

Quick Reference Card

- Detailed instructions for common and infrequent important tasks.

Knowledgebase (knowledge.mcaf)

- Release notes and documentation.
- Supplemental product information.

- Workarounds to known issues.

### Finding release notes and documentation for enterprise products

1. Go to knowledge.mcafee.com and select Product Documentation under Useful links.
2. Select <Product Name> | <Product Version> and select the required document from the list of documents.

COPYRIGHT

COPYRIGHT

Copyright © 2008 McAfee, Inc. All Rights Reserved.

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.

TRADEMARK ATTRIBUTIONS

TRADEMARK ATTRIBUTIONS

AVERT, EPO, EPOLICY ORCHESTRATOR, FLASHBOX, FOUNDSTONE, GROUPSHIELD, HERCULES, INTRUSHIELD, INTRUSION INTELLIGENCE, LINUXSHIELD, MANAGED MAIL PROTECTION, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, MCAFEE.COM, NETSHIELD, PORTALSHIELD, PREVENTSYS, PROTECTION-IN-DEPTH STRATEGY, PROTECTIONPILOT, SECURE MESSAGING SERVICE, SECURITYALLIANCE, SITEADVISOR, THREATSCAN, TOTAL PROTECTION, VIREX, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners.

LICENSE INFORMATION

LICENSE INFORMATION

License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.