[Linux]How to exclude thunderbird from scanning and on demand

[Former Member]

Hi,

I am using Ubuntu for last 10 years and I never had an antivirus installed. But our Organisation mandates us to use Mcafee Endpoint Security.

This is where I am having trouble. For some reason, my thunderbird keeps hanging and I couldn't help. Many times I would disable on-demand scanning using the command:

/opt/isec/ens/threatprevention/bin/isecav --setoasglobalconfig --oas off

This helps a bit for some time. But again after 1 hour or so, I have to do that. I read as per policy any change to globalconfig will be reset.

I also tried changing the risk for thunderbird process and also tried to exclude the Thunderbird profile directory from scanning. But I should say, I am not successful there too.

These are the commands I used:

/opt/isec/ens/threatprevention/bin/isecav  --setprocess --lowrisk  /usr/bin/thunderbird

/opt/isec/ens/threatprevention/bin/isecav --setoasprofileconfig --profile standard --addexclusionrw  --excludepaths <path-to-my-thunderbird-profile>

Did anyone had this problem earlier and solved it successfully on a Linux machine. I know in Windows there is a Mcafee plugin to disable the scan. Or on Windows, there is nice UI which will help us to do what I want. 

Please help.

[sunshinebg]

Witch version of ENS is currently use, ePo managed or standalone? Who is controlling ePo or hosts with ENS? In ePo, admin has the power to do anything with endpoints like exclude or include the specific processes, folders (subfolders), files or executable files. Something like that: Policy catalog: Endpoint Security Threat Prevention : Policy Category > On-Demand Scan > My Default

As you see even checkbox to do not Overwrite exclusions configured on the client  in your case.