Wierd... McAfee Antivirus' On-Access Scan gets disabled by itself

Wierd... McAfee Antivirus' On-Access Scan gets disabled by itself

Secure Home | Search | About
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Wierd... McAfee Antivirus' On-Access Scan gets disabled by itself AK 07-14-2005
Posted by AK on July 14, 2005, 9:20 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi all,

I'm using McAfee's VirusScan Enterprise 7.1.0. I'm experiencing this
wierd problem (probably since today morning) with the On-Access Scan
feature: no matter how many times I enable it, it gets disabled by
itself after a few seconds.

Any ideas what's going on and what I can do about it? Any kind of help
will be appreciated.

Cheers,

AK


Posted by maximillianx on July 14, 2005, 9:49 am
If you were  Registered and logged in, you could reply and use other advanced thread options
You are probably infected with a virus - we got hammered by the sdbot virus
earlier this year, and this was one of the minor symptoms.

I would download stinger from McAfee's website and run it against the box to
see what is going on - http://vil.nai.com/vil/stinger/

Perhaps run HijackThis and see what it tells you - you may need to rename
either stinger or HijackThis (our virus killed these processes unless we
renamed them).

Good luck!
Rob

> Hi all,
>
> I'm using McAfee's VirusScan Enterprise 7.1.0. I'm experiencing this
> wierd problem (probably since today morning) with the On-Access Scan
> feature: no matter how many times I enable it, it gets disabled by
> itself after a few seconds.
>
> Any ideas what's going on and what I can do about it? Any kind of help
> will be appreciated.
>
> Cheers,
>
> AK
>



Posted by David H. Lipman on July 14, 2005, 10:13 am
If you were  Registered and logged in, you could reply and use other advanced thread options

| Hi all,
|
| I'm using McAfee's VirusScan Enterprise 7.1.0. I'm experiencing this
| wierd problem (probably since today morning) with the On-Access Scan
| feature: no matter how many times I enable it, it gets disabled by
| itself after a few seconds.
|
| Any ideas what's going on and what I can do about it? Any kind of help
| will be appreciated.
|
| Cheers,
|
| AK

As another indicated, you may be infected with a virus that disables the the
McAfee
software. However, Stinger only targets ~53 infectors and their variants. A
small subset
of the possible infectors that can possibly cause this kind of problem.

The following tool will simplfy the task using three different "On Demand"
scanners to
find/remove the possible culprit. Instead of 53 infectors and variants, you
will be
scanning with signatures in the range of 90,000 ~ 135,000

Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

It is a self-extracting ZIP file that contains the Kixtart Script Interpreter {
http://kixtart.org Kixtart is CareWare } three batch files, five Kixtart
scripts, one Link
(.LNK) file, this PDF instruction file and two utilities; UNZIP.EXE and
WGET.EXE. It will
simplify the process of using; Sophos, Trend and McAfee Anti Virus Command Line
Scanners to
remove
viruses and various other malware.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal
Mode. This
way all the components can be downloaded from each AV vendor’s web site.
The choices are; Sophos, Trend, McAfee, Exit the menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you
can
download the files and perform a scan in Normal Mode. Once you have downloaded
the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode
[F8 key
during boot] and re-run the menu again and choose which scanner you want to run
in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive
PDF help
file.

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE and/or
FTP.EXE to go
through your FireWall to allow them to download the needed AV vendor related
files.

* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by maximillianx on July 14, 2005, 1:50 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
David -

This looks interesting - - I'm going to check this out for my home users...

Thanks for the tip - !

Rob
>
> | Hi all,
> |
> | I'm using McAfee's VirusScan Enterprise 7.1.0. I'm experiencing this
> | wierd problem (probably since today morning) with the On-Access Scan
> | feature: no matter how many times I enable it, it gets disabled by
> | itself after a few seconds.
> |
> | Any ideas what's going on and what I can do about it? Any kind of help
> | will be appreciated.
> |
> | Cheers,
> |
> | AK
>
> As another indicated, you may be infected with a virus that disables the
> the McAfee
> software. However, Stinger only targets ~53 infectors and their variants.
> A small subset
> of the possible infectors that can possibly cause this kind of problem.
>
> The following tool will simplfy the task using three different "On Demand"
> scanners to
> find/remove the possible culprit. Instead of 53 infectors and variants,
> you will be
> scanning with signatures in the range of 90,000 ~ 135,000
>
> Download MULTI_AV.EXE from the URL --
> http://www.ik-cs.com/programs/virtools/Multi_AV.exe
>
> It is a self-extracting ZIP file that contains the Kixtart Script
> Interpreter {
> http://kixtart.org Kixtart is CareWare } three batch files, five Kixtart
> scripts, one Link
> (.LNK) file, this PDF instruction file and two utilities; UNZIP.EXE and
> WGET.EXE. It will
> simplify the process of using; Sophos, Trend and McAfee Anti Virus
> Command Line Scanners to
> remove
> viruses and various other malware.
>
> C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
> This will bring up the initial menu of choices and should be executed in
> Normal Mode. This
> way all the components can be downloaded from each AV vendor's web site.
> The choices are; Sophos, Trend, McAfee, Exit the menu and Reboot the PC.
>
> You can choose to go to each menu item and just download the needed files
> or you can
> download the files and perform a scan in Normal Mode. Once you have
> downloaded the files
> needed for each scanner you want to use, you should reboot the PC into
> Safe Mode [F8 key
> during boot] and re-run the menu again and choose which scanner you want
> to run in Safe
> Mode. It is suggested to run the scanners in both Safe Mode and Normal
> Mode.
>
> When the menu is displayed hitting 'H' or 'h' will bring up a more
> comprehensive PDF help
> file.
>
> To use this utility, perform the following...
> Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
> Choose; Unzip
> Choose; Close
>
> Execute; C:\AV-CLS\StartMenu.BAT
> { or Double-click on 'Start Menu' in C:\AV-CLS }
>
> NOTE: You may have to disable your software FireWall or allow WGET.EXE
> and/or FTP.EXE to go
> through your FireWall to allow them to download the needed AV vendor
> related files.
>
> * * * Please report back your results * * *
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>



Posted by David H. Lipman on July 14, 2005, 2:14 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| David -
|
| This looks interesting - - I'm going to check this out for my home users...
|
| Thanks for the tip - !
|
| Rob

Rob:

I very very happy to entertain any/all feedback.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Similar ThreadsPosted
McAfee Virus Scan Lock Up July 2, 2006, 3:09 pm
Windows XP shuts down... on antivirus scan March 30, 2007, 5:17 am
Is this a false positive or bug with IE 6, McAfee 8/9/10 or both IE 6 and McAfee? June 26, 2006, 6:57 am
Wierd Processes Running on Windows 2003 Servers July 16, 2006, 9:42 am
disabled NAV ??? November 8, 2005, 4:30 pm
Disabled Links March 15, 2007, 2:44 pm
disabled virus software October 7, 2005, 9:21 pm
firewall disabled by a virus July 20, 2007, 9:53 am
Windows Firewall automatically disabled August 23, 2005, 12:30 am
Firewall disabled, IE blank page - Virus, Trojan? June 14, 2006, 7:43 am

The site map in XML format XML site map

Contact Us | Privacy Policy