diff --git a/include/tests_malware b/include/tests_malware
index 340133a6..c7744dda 100644
--- a/include/tests_malware
+++ b/include/tests_malware
@@ -66,9 +66,17 @@
     Register --test-no MALW-3280 --weight L --network NO --description "Check for clamscan"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
-        logtext "Test: checking process cmdagent (McAfee)"
-        IsRunning cmdagent
-        if [ ${RUNNING} -eq 1 ]; then
+        MCAFEE_RUNNING=0
+        logtext "Test: checking process cma or cmdagent (McAfee)"
+        # cma is too generic to match on, so we want to ensure that it is related to McAfee first
+        if [ -x /opt/McAfee/cma/bin/cma ]; then
+             IsRunning cma
+             if [ ${RUNNING} -eq 1 ]; then MCAFEE_RUNNING=1; fi
+           else
+             IsRunning cmdagent
+             if [ ${RUNNING} -eq 1 ]; then MCAFEE_RUNNING=1; fi
+        fi
+        if [ ${MCAFEE_RUNNING} -eq 1 ]; then
             FOUND=1
             Display --indent 2 --text "- Checking McAfee" --result "FOUND" --color GREEN
             logtext "Result: Found McAfee"