PeteNetLive - KB0000116 - Event ID 257 & 258

0000116

Dated

14/06/10

Revision

0.02

Event ID 257

Problem

Event ID 257

Solution

257	VirusScan Enterprise, message: Would be blocked by behaviour blocking rule (rule is currently in warn mode) (warn only mode!).(from <source> IP <IP> user <user> running VirusScan Enter 8.0 OAS)
258	Would be blocked by port blocking rule (rule is in warn-only mode)
Cause: McAfee Anti Virus
Fix: This harmless alert, which can be ignored. To stop this logging to the event log, open the Viruscan Console, go to Tools -> Alerts -> Additional alerting options, and select "Suppress all except severe alerts (severity <4)". If you are using ePO, you will have to adjust the policies in the same manner. For ePO Managed Machines. 1. Log into ePO, Select "System Tree" > Assigned Policies > Change the prodict to "Virus Scan Enterprise (version) > Alert Policies > My Default. 2. Change the drop down from workstation\server as approriate > Additional allerting Options > "suppress all exept severe alers (severtity <4) > Save.
Comments:

If this post helped you, PLEASE take the time to +1 it.

Please be aware, all information is provided free, but it does cost me to have this site hosted, if I've helped you in any way, or saved you some time/cost please take time to make a donation.

If you have anything to add to an article, or have an article you would like us to publish please feel free to contact PeteNetLive. (Please be aware I get a LOT of email, I cannot assist and fix everyone's problems, please do not be offended if you do not get a response).

References - Credits - Or External Links