Host Checker and Mcafee Antivirus

[geom_]

I have had several users tell me that when they login to our SA4500 they do so succesfully and pass all the host checks. However for some reason their Mcafee AV program pops up frequently.

I haven't seen this in person, but it seems to effect ver 12.x Mcafee AV products. Perhaps, more, but that is all I have confirmed with users.

If anyone knows whats going on, or how to prevent this, I would appreciate it.

[KevinW_]

This is because the juniper software does an application hook and runs as a double extension. Default mcafee policies see this acting as a virus, although it is not. Its the way the application has been installed.

You can get around this by using the mcafee HIP (host intrusion protection) software and create a rule which allows this application behaviour.

[Mrkool_]

well even thehost checker file has the double extension so if the Mcafee was detectig it as a virus it would not allowe the file to run. We have McAfee HIPS running and we had to put the exception in like Kevin said but our McAfee 8.5 corporte edition does not recoginze juniper files as viruses though only HIPS client.

when the AV pops up what does it say?

[NetRat_]

We have a similar even occurring when our RAS is enabled and active, Intranet and Outlook authentication boxes pop every hour or so and only a log out and reboot stops it.

Although it's not a critical error it would suggest an error in configuration.

Any suggestions would be welcome

[zanyterp_]

What message is popping up? Or is it only the application showing it's GUI? How frequent do you have Host Checker evaluate/run on the clients (Authentication>Endpoint Security>Host Checker)?

[SF_Dan_]

I have the same problem. When the dsHostChecker.exe does a QuerySecurityFile and QueryBasicInformationFile on mcshell.exe it invokes the program which pops up momentarly and then closes. I have a case open with McAfee to hopefully resolve this.