Issues when running a full McAfee system scan while also running an active VNC session (Error: Memo
03/26/2020 4 10408
DESCRIPTION: Issues when running a full McAfee system scan while also running an active VNC session (Error: Memory Infected)
When running a Mcafee manual or scheduled system scan and any type of VNC Server or Viewer is running on the scanned PC, 1 of 2 things may happen.
1)The scan stops and cannot complete with an error “Memory Infected” 2)The scan completes but VNC is deleted from the system
This will happen even if there is a custom Mcafee policy excluding VNC programs.
Because VNC is a running process it is housed in memory. The first thing Mcafee scans is the system memory. Because VNC is now being flagged as a PUP (Potentially Unwanted Program) the signature for this PUP “
RemAdm-VNC” is detecting VNC in memory and either stopping the scan or deleting the VNC files.
Step 1) Log into SonicWall and navigate to: Security Services>Client AV enforcement and click on “Create report”
Step 2) Login using mysonicwall.com account credentials that the SonicWall is registered under.
Step 3) Navigate to Groups + Policies and click on the “policy” tab.
Step 6) Scroll down to “Approved Programs” and find any “RemAdm” programs specifying “VNC” IE: RemAdm-VNCView.
Step 7) These signatures should show as blocked. If they do, follow the signature over to the right and click on the “Approve” button for all RemAdm-VNC signatures found.
All RemAdm-VNC signature should now show “Approved”,
Step 8) Scroll back up to the top and click on the “Save” button.
Step 9) This new policy will be pulled down to all computers the next time each individual PC updates with the Mcafee database. For immediate update, go to a PC in question; Right click on the Mcshield in the system tray and click on “update now”. Even if the splash screens says “no new updates available”, the machine in question should have pulled down the modified policy.