注意事项

McAfee8.8的规则保存位置，在注册表项目中有变动，推荐覆盖升级，这样可以完整继承、转换相关设置。

注册表路径：

8.8

HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\SystemCore\VSCore\On Access Scanner\BehaviourBlocking

8.7

HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore\On Access Scanner\BehaviourBlocking

如果是全新安装，更新病毒库的时间会非常长，推荐使用离线病毒库，可以从官网下载：

http://www.mcafee.com/apps/downloads/security-updates/security-updates.aspx

HASH信息

MD5: 89A0A4A1DBC977CF5B676A26E69FDF66
SHA1: 5FF36B6A5A3157CAA1BEE9DB3F8BE6B5EF41BBD8
CRC32: 8D807E0D

更新日志

This release significantly enhances the overall performance of McAfee VirusScan Enterprise and adds the following key features:
Lower system impact
Reductions in boot and shutdown times
Reductions in the number of VSE processes
Faster On-Demand Scanning (ODS)
Faster On-Access Scanning (OAS)
Improved scanned file caching
Reduced memory usage
User Interface for configuring ScriptScan Exclusions
E-mail scanner support for Outlook 2010
Integrated Anti-spyware functionality
For more informatoin, see the documents below:
PD22972 - VirusScan Enterprise 8.8 Release Notes
https://kc.mcafee.com/corporate/index?page=content&id=PD22972
KB70393 - VirusScan Enterprise 8.8 Release Notes (Addendum)
https://kc.mcafee.com/corporate/index?page=content&id=KB70393
PD22973 - What's new: McAfee VirusScan Enterprise 8.8
https://kc.mcafee.com/corporate/index?page=content&id=PD22973

您可能也喜欢：
[征文] A.shun：假如一小时后我的系统崩溃…? (@syncoo)	2011年末“泄密门”安全事件盘点 (@sky84)	免费领取熊猫互联网安全套装2011	McAfee VirusScan Enterprise 8.7i Patch 4	McAfee 8.7I patch4 官方集成版发布
无觅

著名的安全提供商McAfee悄然发布了8.7I 企业版patch4的官方集成版，有授权的朋友可以到官网进行版本更新了。新版本安装后默认进行病毒库更新，且不可选，由于病毒库体积较大，会出现长时间不能完成更新的情况。如果需要暂时停止更新，或使用下载病毒包方式更新，解决方法是进入virusscan 控制台，在AutoUpdate项目上右键手动停止更新进程。

文件信息

• MD5：976ba15a889c9db428bcfd2bd2f8c2bb
• SHA1:6657ec7310eda5d74c44f5098e6e6c57416ea9c2
• 大小：26.3 MB (27,622,876 字节)

McAfee设置备份/还原

停止访问保护，运行regedit命令打开注册表编辑器，导出以下键值备份，需要时双击导入即可：

• HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore
• HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtection

相关链接

• 官方站点（需有授权码）

您可能也喜欢：
最佳绿色软件制作工具：Total Uninstall绿色版 (@portablesoft)	[征文] A.shun：假如一小时后我的系统崩溃…? (@syncoo)	McAfee VirusScan Enterprise 8.7i Patch 4	mcafee 8.7I patch3 官方集成版发布	McAfee VirusScan Enterprise 8.8
无觅

McAfee VirusScan Enterprise 8.7i Patch 4 发布。这是McAfee被英特尔收购后所发布的首个企业版升级包，喜欢尝试新版本的朋友可以跟进一下，或者继续耐心等待官方集成版本的发布。

在安装升级包前请关闭访问保护功能，并登录管理员账户运行更新程序，否则会出现安装失败的情况。已经有安装了Patch 4的朋友反映win7任务栏图标显示的BUG得到了解决，更多的改进可以阅读官方的更新日志。

相关链接

• 官方站点
• 更新说明
• 网盘下载

您可能也喜欢：
[征文] A.shun：假如一小时后我的系统崩溃…? (@syncoo)	2011年末“泄密门”安全事件盘点 (@sky84)	McAfee 8.7I patch4 官方集成版发布	McAfee VirusScan Enterprise 8.8	mcafee 8.7I patch3 官方集成版发布
无觅

继上个月发布McAfee VirusScan Enterprise 8.7i Patch 3补丁包后，今日McAfee发布了mcafee 8.7I patch3 官方集成版本。之前已安装过补丁包的朋友可以不用更新了，如需全新安装记得备份相关设置。本次的集成版体积较小，安装时在线更新为不可取消状态，完成安装的耗时会较长，需要多等待一会。

相关链接

• 点击进入官方站点（需有授权码）

压缩包Hash值

• MD5：fc6eed441a2e51036ea3e3f6595b52b6
• SHA1:85503c93a158c91c70bd40d246464b9f1532722a
• 大小：26.3 MB (27,635,930 字节)

McAfee设置备份/还原

停止访问保护，运行regedit命令打开注册表编辑器，导出以下键值备份，需要时双击导入即可：

• HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\VSCore
• HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtection

您可能也喜欢：
[征文] A.shun：假如一小时后我的系统崩溃…? (@syncoo)	咖啡咖啡杯 (@toodaylab)	McAfee 8.7I patch4 官方集成版发布	mcafee 8.7I patch3	McAfee VirusScan Enterprise 8.7i Patch 4
无觅

McAfee VirusScan Enterprise 8.7i Patch 3本月10日发布后，有一个比较严重的BUG，在启用了禁止伪装Windows进程选项时，会造成系统启动、切换用户帐户时无法显示桌面，我当时也提到过临时解决方案，McAfee官方也及时发现了该BUG，并建议用户临时禁用该功能。

一个好消息时，今日McAfee已经提供了修复该问题的热修复补丁，并进行了自动升级推送，之前有进行过自定义排除的朋友，可以取消排除项目，重新启用该功能了。首次安装Patch 3的朋友，记得安装完成后，暂不要重启系统，直接启动在线更新，以便能够正常使用系统。

更新日志

Problem

After installing VirusScan Enterprise (VSE) 8.7i Patch 3 and restarting your computer, the Windows desktop is not displayed with the Access Protection rule Standard Protection: Prevent Windows Process spoofing enabled.
Windows Task Manager shows that Explorer.exe is not running.

System Change

Installed Patch 3 for VSE 8.7i and restarted computer.

Cause

The Access Protection rule Standard Protection: Prevent Windows Process spoofing is enabled and configured to Block. The issue is caused by changes to vscan.bof, a content file for Access Protection rules and buffer overflow protection.
This issue has been reported for the Explorer.exe process. Other Windows processes are not affected.

Solution

This issue is resolved by an updated vscan.bof content file on the McAfee Common Updater site. This updated file will be automatically downloaded and applied to all VSE systems (regardless of patch level) in the same was as daily DAT files.
This means Patch 3 can be applied and systems will never encounter the issue.
The updated package is also attached to this article.
NOTE: This content file is also used by VirusScan Enterprise 8.5i. After the update, both VSE 8.7i and 8.5i will report version 480 for the Buffer Overflow and Access Protection DAT Version.

Workaround

Disable the Access Protection rule.
NOTE: Because Explorer.exe is not running, there is no Start button or VirusScan Enterprise (VSE) icon in the system tray.
To open the VirusScan Console

1. Press CTRL+ALT+DEL.
2. Click Task Manager, File, New Task (Run...).
3. Navigate to C:\Program Files\McAfee\VirusScan Enterprise\mcconsol.exe.
4. Click OK.

5. Right-click Access Protection and select Properties.

6. Select Anti-virus Standard Protection.

7. Select Prevent Windows Process spoofing and deselect the Block option.
   NOTE: Optionally, you can deselect Report to completely disable the rule.

8. Click OK.

Related Information

If you log into your system quickly, you might not encounter this issue, even when the rule to block spoofing of Windows processes is enabled. This is because Explorer.exe is running before the Access Protection Rule takes effect.

Attachment 1

VSE87HF557464.zip
77K • < 1 minute @ 56k, < 1 minute @ broadband

提供下Patch 3的下载，不包含主程序

点击此处进入下载页

您可能也喜欢：
三星Windows Phone 7新机i916真机曝光 (@mobisky)	微软发布windows 7正版检测补丁KB971033 (@sky84)	mcafee 8.7I patch3	mcafee 8.7I patch3 官方集成版发布	mcafee 8.7I patch1
无觅

我这里的使用情况来看，p3的默认规则中有需要自行解决的地方，在防病毒标准防护选项中，如果启用了禁止伪装Windows进程，会误拦截很多系统进程。这个问题在之前的几个版本中，都是没有出现过的。特别是，若不加以排除，会造成系统帐号登录出现问题，比如注销后在登录帐户、切换用户帐户等操作后，都会造成无法显示桌面的问题。根据日志排查，应该是拦截了userinit.exe对explorer.exe的调用。另外还有一些类似的问题，都需要手工排除一下。

建议有同样问题的朋友，在禁止伪装Windows进程选项中，重点排除下explorer.exe、userinit.exe、taskmgr.exe，为安全起见，可以使用完整路径排除，比如：C:\Windows\system32\userinit.exe

您可能也喜欢：
咖啡咖啡杯 (@toodaylab)	女仆主题咖啡 (@qingge)	麦咖啡去除QQ2009正式版广告方法	mcafee 8.7I patch1	mcafee 8.7I patch3 官方集成版发布
无觅

从运行情况上看，安装patch1后，程序的资源占用也较之前有了改善，进程的资源消耗亦有所减少。另一个个人很关心的，病毒库更新后的高资源占用问题，目前尚无法得知有无改善，下次升级时就会有答案了。

版权问题就不贴官方的下载链接了，因为官网下载需要Grant Number，相信使用麦咖啡的网友也都知道如何获取^^

具体的更新日志：

Known issues in this release of the software are described below:

Issue: In some situations, the product switches over to using the normal copy of the DAT files, instead of the runtime DATs:
If the McAfee AntiSpyware Enterprise module is installed after VirusScan Enterprise 8.7i Patch 1 is on the system, some of the new registry settings, which are new for the runtime functionality, were changed back. This resolves itself with a restart of the McTaskManager service or with a reboot.
If one of the scanners is busy on a large file when the AutoUpdate process posts the revised copy of the DATs, the process of refreshing the runtime copy of the DATs times out. All scanners use the normal DATs until the next successful update.
The VirusScan Modules* will not use the runtime DAT functionality until they received their next Patch.

Issue: With the improved functionality of the on-access scanner memory scan, lower and middle ranged systems may see a performance impact at startup and after a successful AutoUpdate of the engine or DATs. Currently the Process on enable option is enabled by default on the shipping version of VirusScan Enterprise 8.7i. McAfee recommends that in a managed environment, disable this option prior to deployment of the Patch, until the impact of memory scanning can be determined for your environment. It is not possible to maintain both the more comprehensive scanning that comes with Patch 1 and later, and the former level of scanning. Therefore, only the more comprehensive scan is used.
NOTE FOR CURRENT AND NEW USERS:
The Patch installation does not modify current settings to disable the Process on enable option.
The VirusScan 8.7i NAP and extension that are included with the Patch do change the McAfee Default policy, but do not modify the My Default policy, or any custom policy settings that were made prior to the checkin of the new NAP/extension.
The VirusScan Enterprise 8.7i Repost with Patch now installs with the Process on enable option disabled, unless the Maximum Security option is selected during the installation.

Issue: VirusScan 8.7i Patch 1 introduced an issue with Microsoft Outlook where keyboard entries made during the delivery of an email were lost.
NOTE: This issue is resolved by HotFix VSE85HF464768, included with this release. Refer to "Additional Steps for HotFix 464768" for installation instructions.

Issue: The Access Protection rule "Prevent termination of McAfee processes" was improperly disabled, on 32-bit systems, even when the managed policy specified otherwise.
NOTE: This issue has been resolved in the fully released version of the Patch. HotFix VSE85HF464768, included with this release, resolves the issue for customers who installed Patch 1 during the managed release cycle. Refer to "Additional Steps for HotFix 464768" for installation instructions.

Issue: The Patch installer included an MSI deferred action to resolve an issue found when attempting to uninstall the Patch on some newer operating systems. The deferred.mfe file updated the cached MSI of the currently installed VirusScan 8.7i product. If the Patch is included in a McAfee Installation Designer customized package, the deferred.mfe file was not included, and therefore the Patch might not be able to be uninstalled in some newer operating systems.

Issue: If you installed this release interactively and cancelled the installation on a system where a previous Patch was installed, after the rollback was complete, the previous Patch might no longer reported to ePolicy Orchestrator or appeared in the About VirusScan Enterprise window.

Issue: Installing the Patch and specifying a log file path using the Microsoft Installer (MSI) switch “/L” did not log to the specified path. A log file capturing full data was logged to the folder “McAfeeLogs” under the Temp folder.

Issue: If Host Intrusion Prevention 6.x or later was installed and disabled prior to installing VirusScan Enterprise, it was necessary to re-enable Host Intrusion Prevention and disable it again, in order for VirusScan Buffer Overflow Protection to be properly enabled.

Issue: Uninstalling VirusScan Enterprise Patches is possible for computers running Windows Installer v3.x or later. This technology is not fully integrated for Windows 2000 operating systems, so there is no option to remove the Patch in Add/Remove programs. See instructions under Removing the Patch for removal via command-line options.

Issue: Patches for VirusScan Enterprise 8.7i can only be uninstalled via Add/Remove programs, not via ePolicy Orchestrator.

Resolved issues
The resolved issues are divided into subsections per patch, showing when each fix was added to the compilation.
Patch 1 resolved issues:

Issue: An unauthenticated remote denial-of-service attack was discovered. (Reference: 470184)
Resolution: The product no longer allows the denial-of-service attack.

Issue: Under certain conditions, the Lotus Notes scanner of VirusScan Enterprise can mistakenly deny access to the Lotus Notes internal processes, if a note was being accessed more than once. (Reference: 438541)
Resolution: The Lotus Notes scanner has been adjusted to better handle re-entrance scanning of the same note.

Issue: Silent installs may fail on hard drives that are designated as dynamic. The on-access scanner service fails to start, and the installation will roll back. (Reference: 443669)
Resolution: The patch 1 and later install packages will now install to a dynamic disk, silently.

Issue: Sporadic crashes were seen on multi-processor systems, with the Lotus Notes scanner file ncdaemon.exe, during startup and general use of Lotus Notes. (Reference: 442337)
Resolution: The Lotus Notes scanner has been corrected to prevent a race condition where different scanner threads were starting and stopping out of sequence.

Issue: A 8E bugcheck (blue screen) sometimes occurred when VirusScan Enterprise 8.7i was installed along with Checkpoint VPN-1 SecureClient. (Reference: 438771)
Resolution: The link driver was updated to avoid probing kernel memory unnecessarily.
NOTE: For this fix to prevent the above issue, the files need to be placed on the system during the installation of VirusScan Enterprise, before the services start. The repost of VirusScan Enterprise 8.7i with Patch 1 will be needed to see the resolution.

Issue: A flaw in the caching algorithm sometimes caused files in removable media to not be scanned. (Reference: 443104)
Resolution: The Anti-Virus Filter driver was updated to clear the cache of removable media upon attaching to the system.

Issue: The on-access scanner contained a flaw in the scan on close logic. This could cause a file to be queued up for scanning a second time. (Reference: 434475)
Resolution: The Anti-Virus Filter driver no longer queues these unnecessary scan requests.

Issue: During an upgrade from a customized VirusScan Enterprise 8.5i to VirusScan Enterprise 8.7i, An issue sometimes occurred where the configuration tool did not properly backup and restore the registry information. The installation was left in a state where some of the product information still showed as the older version. (Reference: 443019)
Resolution: The McAfee Installation Designer configuration applicator has been changed to be more comprehensive in backing up and in version checking during the upgrade, in order to prevent failures by other McAfee product installations that require version 8.7i.
NOTE: For this fix to prevent the above issue, the files need to be placed on the system during the installation of VirusScan Enterprise, before the services start. The repost of VirusScan Enterprise 8.7i with Patch 1 will be needed to see the resolution.

Issue: On Microsoft Windows Vista SP1 or 2008 server, sharing violations could occur when working with remote files while network drive scanning was enabled. This resulted in being denied access to files, or being unable to modify or save a file. (Reference: 447282)
Resolution: The Anti-Virus Filter driver has been updated to better handle potential sharing violations that could occur and avoid conflicts.

Issue: Prolonged use of the VirusScan Console was causing delays in loading subsequent loading of the Console window. (Reference: 456831)
Resolution: The VirusScan Console plug-in was corrected to properly clean up the .tmp files it creates at load time.

Issue: Access Protection rules were being triggered during creation of a VirusScan customized installation package via McAfee Installation Designer. This could lead to a crash of the McAfee Installation Designer tool. (Reference: 435728)
Resolution: The VirusScan Email Scan library appropriately handles the new Sensitivity level setting when it is displayed in the McAfee Installation Designer window.

Issue: Certain detections with multiple infections or clean actions were logging the action two times. One entry was made during the middle of the process, and the other during the final resolution. (Reference: 404787)
Resolution: The Common Shell scanner has been updated to report only the final resolution of the detection.

Issue: A 8E bugcheck (blue screen) might occur during the “Memory for Rootkits” portion of an on-demand scan. (Reference: 445490)
Resolution: The code analysis driver now uses a more robust method of querying the system for driver object data.

Issue: Access Protection block rules that were created for USB devices sometimes did not handle removing and reinserting the device multiple times. (Reference: 457415)
Resolution: The Access Protection, Anti-Virus Filter, and Link drivers have been updated to better handle reinserting the device.

Issue: The on-access scanner was not properly utilizing the Scan files opened for Backup option. (Reference: 457416)
Resolution: The Anti-Virus Filter driver has been rectified to properly interpret the flag being sent from the on-access scanner.

Issue: In an ePolicy Orchestrator managed environment, the agent’s Collect and Send Properties function could cause the McAfee Product Manager service to spike its CPU utilization for extended periods of time. (Reference: 457421)
Resolution: The VirusScan Management Plug-in has been updated to call for the scan engine and DAT files via a new API call, rather than initializing the engine to retrieve the information. This lessens the CPU time involved during the agent Collect and Send Properties function.

Issue: With certain Access Protection rules enabled, VirusScan Enterprise was failing to return information to the Checkpoint SecureClient software. (Reference: 444667)
Resolution: The binaries for Checkpoint integration have been updated to properly request information from VirusScan Enterprise.

Issue: Attempting to start an on-demand scan via the VirusScan tray icon could result in an error on Microsoft Windows Vista. (Reference: 446950)
Resolution: The VirusScan tray icon correctly calls the on-demand scanner on User Access Controlled operating systems.

Issue: Creating a McAfee Installation Designer change package for VirusScan Enterprise and the AntiSpyware Enterprise Module, sometimes failed to upgrade the evaluations to licensed versions, for both products. (Reference: 437509)
Resolution: McAfee Installation Designer configuration applicator upgrades the licenses of VirusScan Enterprise and the AntiSpyware Enterprise Module when they are both evaluations.

Issue: The VirusScan Console On-Delivery Email Scanner entry was not worded correctly in German. (Reference: 438931)
Resolution: The VirusScan Resource file updates the displayed text to the correct wording in German.

Issue: One of the ScriptScan “McLogEvent” entries was always recorded in English. (Reference: 431071)
Resolution: The Announcer library was updated to remove the extra notification.

Issue: In some cases, VirusScan Enterprise was not properly displaying Patch information about itself and currently installed VirusScan Modules*. (Reference: 456826)
Resolution: The VirusScan Management Plug-in has been updated to gather the current information about Patch levels of its installed VirusScan Modules*.

Issue: When there were HotFixes or Patches available for the VirusScan Modules*, they were not being downloaded to the clients. (Reference: 445494)
Resolution: The AutoUpdate binary was modified to check for the existence of the VirusScan Module* licenses when deciding which HotFixes or Patches to install.

Issue: Script errors were seen when attempting to view the Japanese text, of the product description window, in ePolicy Orchestrator 3.6.x. (Reference: 434203)
Resolution: The VirusScan 8.7i NAP file has been updated to display the Japanese page in its proper Unicode format (UTF-8).

Issue: The alert options for Network Appliance Filer and ICAP scanners were visible on the workstation ePolicy Orchestrator policies. (Reference: 448361)
Resolution: The VirusScan 8.7i NAP and extension have been updated to remove the alert options for alert options for Network Appliance Filer and ICAP scanners, from the workstation policy, as those scanners are server specific.

Issue: Some ePolicy Orchestrator operational events were not being generated for the VirusScan Modules*. (Reference: 434423)
Resolution: The VirusScan Reports extension updates the current VirusScan Enterprise Event IDs (1329 – 1339) to be used for the VirusScan Modules*.

Issue: The on-demand scan log file validation checked for invalid file characters, including the "<" and ">" characters. (Reference: 433776)
Resolution: The VirusScan 8.7i extension validation for the path name of the on-demand scanner log file now allows the "<" and ">" characters, which are needed for ePolicy Orchestrator macro variables.

Issue: The alert options for the VirusScan Modules* would not gray out when inheritance was enforced on the parent policy. (Reference: 434231)
Resolution: The VirusScan 8.7i NAP now properly enforces inheritance on the VirusScan Module alert options.

Issue: Events generated by the VirusScan Enterprise for Offline Virtual Images 1.0 software were not being generated in ePO reports. (Reference: 439832)
Resolution: The McAfee Announcer library changed properties of the events to support current reporting in ePolicy Orchestrator 3.6.1.

Issue: Scanning events generated by VirusScan Enterprise 8.7i were not populating the Task Name with proper information. (Reference: 453515)
Resolution: The McAfee Announcer library now populates the Task Name with the scanner that generated the event.

Issue: The Access Protection includes and exclude fields permitted a limited number of characters in the extension interface. (Reference: 457418/457419)
Resolution: The VirusScan 8.7i extension updates the maximum limit of the include and exclude fields, to be consistent with the point-product interface.

Issue: Scanner exclusions that were entered in ePolicy Orchestrator with a preceding blank space did not show up correctly when they were enforced on the client. (Reference: 457420)
Resolution: The VirusScan 8.5i extension has been updated to strip any preceding blank spaces from exclusions when they are entered in ePolicy Orchestrator.

Issue: VirusScan Enterprise added some new events that were not included in the default event filter, which was provided by ePolicy Orchestrator. (Reference: 462927)
Resolution: The VirusScan Reports extension updates the current list to allow filtering of these events.

您可能也喜欢：
创意咖啡椅 (@ycy8)	咖啡咖啡杯 (@toodaylab)	麦咖啡去除QQ2009正式版广告方法	mcafee 8.7I patch3	mcafee 8.7I patch3 发布热修复补丁
无觅

首先在麦咖啡的访问保护规则中新建一条用户自定义规则，名称任意都可以，比如qq去ad啥的，要包含的进程为*，要阻止的文件或文件夹名为Misc.db，要禁止的文件操作为新建，这样就可以了。注意请在初次安装qq2009正式版后就设定并此规则，如果已经登录，请到C:\Documents and Settings\用户名\Application Data\Tencent\Users\，找到你的QQ号码，在该目录下找到qq子目录并删除里面的Misc.db文件。另外建议取消报告，不然一定会见红的。

如果没有安装麦咖啡，可以尝试利用windows 下文件不能重名的限制来进行屏蔽，同样的需要打开C:\Documents and Settings\用户名\Application Data\Tencent\Users\，找到你的QQ号码，如果没有号码是你还没有登录过，可以先登录一下。定位到该目录下的QQ目录里，找到名字为“Misc.db”的文件，将该文件改名或删除，右键新建文件夹重命名为“Misc.db”。目录是隐藏的，请自行在工具-文件夹选项中勾选显示隐藏的文件和文件夹。局限性是对新使用的qq号码无效，需要重复操作一次。

其它部分的ad，仍可使用beta版本时的方法，这里不在重复了。

ps：以上仅为学习麦咖啡访问规则做的学习笔记，若有异议我会马上修正，切勿跨省追捕。

您可能也喜欢：
奇瑞QQ广告赏：寂寞悲伤的加油站君 (@toodaylab)	拒绝沉闷！十二组国外创意广告设计欣赏 (@toodaylab)	QQ2009自己动手去AD	qq2009发送消息失败的参考解决方法	QQ无法登陆，腾讯官方公告
无觅