topic Re: CSA and McScript_InUse.exe in Network Security

CSA and McScript_InUse.exe

andy — Sun, 10 Mar 2019 09:13:49 GMT

I am trying to allow the McAfee agent to run on Windows PCs without popping up CSA warnings. I ran through the Wizard to allow this exception, but it doesn't seem to be working correctly. Is there something I am missing?

Re: CSA and McScript_InUse.exe

tsteger1 — Tue, 11 Jan 2005 20:25:44 GMT

Was this trojan detection? You may want to create an exception for the folder and all .exe's instead of trying to do individual .exe's. I made one just for mcscript_inuse.exe downloading and executing and it seems to work ok.

Re: CSA and McScript_InUse.exe

andy — Tue, 11 Jan 2005 23:32:14 GMT

Yes, it was a trojan detection. How do I add the exception for the whole C:\Program Files\Network Associates\Common Framework\ folder?

Re: CSA and McScript_InUse.exe

tsteger1 — Wed, 12 Jan 2005 01:08:02 GMT

Before you do that, confirm that the following is true:

The wizard created an application class called "McScript_InUse.exe" if you accepted the defaults.

Make sure it's in the trojan detection rule under "Downloading and invoking executable files"

That should have been all you needed to do.

If it's in a group exception, try adding it to the main TD rule instead.

If this is true and you still have errors with that executable there may be something else going on.

If there are other executables causing the alerts, then a folder or file set exception may work better. You want to be careful with those because it could allow a bad executable to run in the directory.

Tom

Re: CSA and McScript_InUse.exe

gclevenger — Fri, 04 Mar 2005 14:39:15 GMT

I am having the exact same problem. Did the folder/file set exeption work for you?

Re: CSA and McScript_InUse.exe

jarvoy — Tue, 08 Mar 2005 20:55:18 GMT

I struggled with this one too. In this scenario the wizard just flat out doesn't work. What I ended up doing was changing the process in the application class to read:

**\Program Files\Network Associates\Common Framework\*

Once this was applied as an exception to the TD rule (Downloading and invoking executable files) all was fine.

Re: CSA and McScript_InUse.exe

aduerr — Thu, 24 Mar 2005 07:49:12 GMT

Hi,

I tried adding Virus Scanner Module to TD exception first. After that I gave Application Class McScript_inUse.exe full file access (read&write) and application start control to all files belonging to **\Program Files\EPO\**\* and **\Program Files\Network Associates\**\*.

With triggering logging for these rules I checked that I get hit counts on them, but still getting alerts an the TD exception for downloading and invoking files.

Regards,

Arne

Re: CSA and McScript_InUse.exe

gclevenger — Thu, 24 Mar 2005 11:07:55 GMT

Cisco has a Word Doc that tells exactly how to get around this problem. If you send me an email, I will forward this doc to you. cisco1.10.ccie7965@spamgourmet.com

Re: CSA and McScript_InUse.exe

andy — Mon, 04 Apr 2005 14:45:17 GMT

My email address is already listed in the post.

Re: CSA and McScript_InUse.exe

tsteger1 — Mon, 04 Apr 2005 16:02:32 GMT

If the document is freely available on this web site, please share the link with the rest of us.

Thanks

Tom