Release Notes for McAfee® VirusScan® Enterprise for Storage 1.0.2

By default, Artemis settings from VirusScan Enterprise On-Access Scan will be used.

If you intend to configure different Artemis settings for Storage:

1. Go to the Registry Editor.
2. Navigate to the following path:

   For NetApp	HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSES\NetApp
   For ICAP	HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSES\ICAP

3. Configure the following DWORD values:

   DWORD Value name	Value data
   ArtemisEnabled	0 or 1 0 — Disable 1 — Enable
   ArtemisLevel	0 to 4 0 — Very low 1 — Low 2 — Medium 3 — High 4 — Very high

4. From the Services console, restart the McAfee VirusScan Enterprise for Storage service.

The ePolicy Orchestrator Migration tool might fail to migrate the existing policies and tasks from an ePolicy Orchestrator server that uses Windows NT authentication for ePolicy Orchestrator access. In some cases the ePolicy Orchestrator Migration tool needs to pass the SQL administrator password as a parameter for the ePolicy Orchestrator Migration tool.

Workaround:

Run ePOPolicyMigration.exe from the command line, and add the /PASSWORD switch and the SQL administrator password.

For example, type: [path]\epopolicymigration.exe /vses /password=sql_admin_password

The firewall in McAfee Host Intrusion Prevention may block communication on the ICAP communication port set by default in McAfee VirusScan Enterprise for Storage (port 1344). To resolve the conflict, change the port used by VirusScan Enterprise for Storage in the properties. Alternatively, see the Host Intrusion Prevention documentation for details about configuring the Host Intrusion firewall to allow communication on the port used by ICAP.

These issues have been communicated to Sun and are known issues. Please contact Sun for further information.

When detection alerts are sent to Alert Manager from McAfee VirusScan Enterprise for Storage, the alert message might incorrectly state that OAS (On Access Scanning) denied access to the file. The AV scanner name is properly shown in these messages, you might consider customizing this message by removing the reference to the OAS scanner.

When files are accessed on the NetApp Filer from the Scan Server the NetApp Filer will not request those files to be scanned.

This issue has been communicated to NetApp and is a known issue. Please contact NetApp for further information.

The VirusScan Enterprise Repair feature will not repair the files for the McAfee VirusScan Enterprise for Storage product. If repair is needed to the McAfee VirusScan Enterprise for Storage product, rerun the installer and select Repair during the re-installation. A KB article exists explaining the repair feature for VirusScan Enterprise: KB60029

If you enable or disable alerts for VirusScan Enterprise for Storage, or change any of the additional alerting options using the VirusScan Console you need to restart the VirusScan Enterprise for Storage service for the changes to take effect.

After the localization was completed for the VirusScan Enterprise for Storage Product Guide, ePolicy Orchestrator 4.0 extension Help, and VirusScan Console Help the following "How scanning of ICAP servers works" section was added.

The following process occurs when an ICAP client requests a file scan by VirusScan Enterprise for Storage:

1. The ICAP client contacts VirusScan Enterprise for Storage and requests that a specific file be scanned.
2. The file is transferred to a temporary location on the computer running VirusScan Enterprise for Storage, where it is scanned.
3. If the file is found to be a threat, the action taken depends on the following VirusScan Enterprise for Storage configuration:

• If Clean files automatically is selected, any threats found cause an attempt to clean the file.
  • If the file is successfully cleaned, VirusScan Enterprise for Storage notifies the ICAP client that the file was a threat and was successfully cleaned, and VirusScan Enterprise for Storage returns the cleaned file to the ICAP client.
  • If unable to successfully clean the file, VirusScan Enterprise for Storage follows the ICAP standard by replacing the file with an HTML message stating that the original file is a threat and that it was unable to clean the file.
• If Continue scanning is selected, VirusScan Enterprise for Storage notifies the ICAP client that the file is a threat and the ICAP client then blocks access to this file.

The installation section of the VirusScan Enterprise for Storage, Product Guide contains simple instructions for installing the VirusScan Enterprise for Storage software module. However, there may be times when you want to install the product from the command-line with different parameters to change the default behavior. The following section provides the basic format for the command-line operation and also some common parameters.

• Installing locally from command-line:

  setup.exe /S /v"<command-line options>"

• Installing from ePO Deployment task (input in the command-line form field):

  /v"<command-line options>"

  Where <command-line options> is a space-delimited set of valid MSI flags. For example:

  • /qn — silent install
  • /quiet — same as /qn
  • INSTALLDIR=<Path to a Directory> — alternative installation directory
  • /l*v <Path to a LogFile> — log the installation activity to the following location

After the localization was completed for the VirusScan Enterprise for Storage Product Guide, ePolicy Orchestrator 4.0 extension Help, and VirusScan Console Help the following sections were modified:

• Managing the list of file types scanned — replaced step 1 with the following text:
  1. Start NetApp configuration using either of the following:
     • From ePolicy Orchestrator 4.0, select Systems | Policy Catalog, select VirusScan Enterprise for Storage 1.0.2 from the Product drop-down list, select NetApp Policies in the Category drop-down, select edit from the Actions column of the display, and select the Scan Items tab.

• Configuring the list of ICAP file types scanned — replaced step 1 with the following text:
  1. Start ICAP configuration using either of the following:
     • From ePolicy Orchestrator 4.0, select Systems | Policy Catalog, select VirusScan Enterprise for Storage 1.0.2 from the Product drop-down list, select NetApp Policies in the Category drop-down, select edit from the Actions column of the display, and select the Scan Items tab.

If you perform a repair install of VirusScan Enterprise it causes the strings.bin file to return to the original version that is not compatible with VirusScan Enterprise for Storage.

The workaround is to perform a repair install of VirusScan Enterprise for Storage by running the setup.exe again and choose the Repair option. This causes the strings.bin file to be updated to the version compatible with VirusScan Enterprise for Storage.

The installation log (VSESTOSetup.log) for the VirusScan Enterprise for Storage is stored in [current user]%temp%, where [current user] refers to the user performing the installation.