McAfee Enterprise AV Problem

Mike · External Since: Jul 26, 2007 Posts: 8

Hi, we have a large sitie license forMcafee Enterprise AVsoftware. One of
our installations is a closed network w/o Internet access. LAtely, I'm
unable to upgrade the DAT files on this network. Last night I googled the
problem and ran across a message that states users must have a valid Mcafee
license to able to upgrade products. We have a valid license for that
installation but it doesn't have Internet access, which I guess, is needed
to validate the license.

Help

Mike

David H. Lipman · External Since: Jul 04, 2003 Posts: 2245

From: "Mike"

| Hi, we have a large sitie license forMcafee Enterprise AVsoftware. One of
| our installations is a closed network w/o Internet access. LAtely, I'm
| unable to upgrade the DAT files on this network. Last night I googled the
| problem and ran across a message that states users must have a valid Mcafee
| license to able to upgrade products. We have a valid license for that
| installation but it doesn't have Internet access, which I guess, is needed
| to validate the license.

| Help

| Mike

What version ?
v7.0E, v7.1E, v8.0i or v8.5i ?

McAfee Enterprise AV does NOT validate the license when it downloads signatures. This is
retail function.

How are you providing DAT files ?
- SuperDAT ?
- ePO ?

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

foghollow · External Since: May 09, 2007 Posts: 33

In article , says...
> Hi, we have a large sitie license forMcafee Enterprise AVsoftware. One of
> our installations is a closed network w/o Internet access. LAtely, I'm
> unable to upgrade the DAT files on this network. Last night I googled the
> problem and ran across a message that states users must have a valid Mcafee
> license to able to upgrade products. We have a valid license for that
> installation but it doesn't have Internet access, which I guess, is needed
> to validate the license.
>
> Help
>
> Mike
>
I don't think it's your licence. I've had a few machines 'go funny' lately too, and it seems to be
something triggering the well-known framework problem. Possibly connected to the CMA problem
that was publicised recently.

So first try just using the SDAT to force an update and see if it clears the problem
If not, a simple un- & re- install might do it
Failing that you're into frminst /forceuninstall (or frmpkg /forceuninstall) followed by a re-install

Of course, checking the updater's logs might show it up as something very simple that doesn't need
all that

--
Snob? Were I a snob, I wouldn't be talking to you.

Mike · External Since: Jul 26, 2007 Posts: 8

"David H. Lipman" wrote in message

> From: "Mike"
>
> | Hi, we have a large sitie license forMcafee Enterprise AVsoftware. One
> of
> | our installations is a closed network w/o Internet access. LAtely, I'm
> | unable to upgrade the DAT files on this network. Last night I googled
> the
> | problem and ran across a message that states users must have a valid
> Mcafee
> | license to able to upgrade products. We have a valid license for that
> | installation but it doesn't have Internet access, which I guess, is
> needed
> | to validate the license.
>
> | Help
>
> | Mike
>
>
>
> What version ?
> v7.0E, v7.1E, v8.0i or v8.5i ?
>
> McAfee Enterprise AV does NOT validate the license when it downloads
> signatures. This is
> retail function.
>
> How are you providing DAT files ?
> - SuperDAT ?
> - ePO ?
>
v7.x I d/l the .windows-intel DAT files (not super dat) from the Mcafee
website. Installed Mcafee will not let me install upgrade to v8.01
http://www.mcafee.com/apps/downloads/security_updates/dat.asp

Mike · External Since: Jul 26, 2007 Posts: 8

"foghollow" wrote in message
> I don't think it's your licence. I've had a few machines 'go funny' lately
> too, and it seems to be
> something triggering the well-known framework problem. Possibly connected
> to the CMA problem
> that was publicised recently.
>
> So first try just using the SDAT to force an update and see if it clears
> the problem
> If not, a simple un- & re- install might do it
> Failing that you're into frminst /forceuninstall (or frmpkg
> /forceuninstall) followed by a re-install
>
> Of course, checking the updater's logs might show it up as something very
> simple that doesn't need
> all that
>
> --
Good points all, but I thinbk I tried to install a superdat file. The
problem started a few months ago and seems to be spreading to other PCs on
the network. Will check logs. Will not uninstall reinstall. What does
frminst /forceuninstall (or frmpkg /forceuninstall) mean?

mike

foghollow · External Since: May 09, 2007 Posts: 33

In article , says...
>
> frminst /forceuninstall (or frmpkg /forceuninstall) mean?

You should have either frminst.exe or frmpkg.exe in one of the McAfee folders. It's involved in the
installation of the McAfee Framework Service. Running it with the /forceuninstall switch will remove
the framework, which may then allow you to uninstall the whole thing. It's sometimes been found
with an un-/re-install that some of the framework files don't get deleted in the un- and then don't
get overwritten in the re-, leaving a problem intact; the /forceuninstall gets round that.

Since you see your problem slowly spreading across your machines, it may be you have some
infestation that got in under the radar somehow and is messing with the permissions. I'd maybe try
downloading something like AntiVir, which will (iirc) install and run in Safe Mode, to see if it picks
anything up.

--
Snob? Were I a snob, I wouldn't be talking to you.

David H. Lipman · External Since: Jul 04, 2003 Posts: 2245

From: "Mike"

| v7.x I d/l the .windows-intel DAT files (not super dat) from the Mcafee
| website. Installed Mcafee will not let me install upgrade to v8.01
| http://www.mcafee.com/apps/downloads/security_updates/dat.asp
|

Either you have to use the EXE SuperDAT or you will have to come up with some other
distribution method, such as ePO, if the PCs don't have an Internet connection.

Do you mean Enterprise v8.0i ?
Did you try to remove v7.xE prior to trying to installing Enterprise v8.0i (or v8.5i).

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Mike · External Since: Jul 26, 2007 Posts: 8

"David H. Lipman" wrote in message

> From: "Mike"
>
>
> | v7.x I d/l the .windows-intel DAT files (not super dat) from the Mcafee
> | website. Installed Mcafee will not let me install upgrade to v8.01
> | http://www.mcafee.com/apps/downloads/security_updates/dat.asp
> |
>
> Either you have to use the EXE SuperDAT or you will have to come up with
> some other
> distribution method, such as ePO, if the PCs don't have an Internet
> connection.

I used the exe supdat it runs completes the install the install log ooks
right but when I run the program it replies the dat files aren't installed
reinstall the program.
>
>
> Do you mean Enterprise v8.0i ?
> Did you try to remove v7.xE prior to trying to installing Enterprise v8.0i
> (or v8.5i).

We have a license for v8.0i which I managed to install on another PC but
same error message as above. It's infected.
It's definitely infected. One of the error messages - error 1920. service
network associates mcshield(mcshield) failed to start. verify that you have
sufficient privileges to start system services, I was logged on as
administrator when the error occured.

Mike · External Since: Jul 26, 2007 Posts: 8

"foghollow" wrote in message

> In article , says...
>>
>> frminst /forceuninstall (or frmpkg /forceuninstall) mean?
>
> You should have either frminst.exe or frmpkg.exe in one of the McAfee
> folders. It's involved in the
> installation of the McAfee Framework Service. Running it with the
> /forceuninstall switch will remove
> the framework, which may then allow you to uninstall the whole thing. It's
> sometimes been found
> with an un-/re-install that some of the framework files don't get deleted
> in the un- and then don't
> get overwritten in the re-, leaving a problem intact; the /forceuninstall
> gets round that.
>
> Since you see your problem slowly spreading across your machines, it may
> be you have some
> infestation that got in under the radar somehow and is messing with the
> permissions. I'd maybe try
> downloading something like AntiVir, which will (iirc) install and run in
> Safe Mode, to see if it picks
> anything up.
>
> --
I installed a June '07 version of AntiVir but could find an updated DAT to
install. I ran the program but it did not find any virus.On two of the PCs
before restarting they displayed the following error message - "floppy disk
is infected remove disk" or something close to it.

Mike · External Since: Jul 26, 2007 Posts: 8

"foghollow" wrote in message

> In article , says...
>>
>> frminst /forceuninstall (or frmpkg /forceuninstall) mean?
>
> You should have either frminst.exe or frmpkg.exe in one of the McAfee
> folders. It's involved in the
> installation of the McAfee Framework Service. Running it with the
> /forceuninstall switch will remove
> the framework, which may then allow you to uninstall the whole thing. It's
> sometimes been found
> with an un-/re-install that some of the framework files don't get deleted
> in the un- and then don't
> get overwritten in the re-, leaving a problem intact; the /forceuninstall
> gets round that.
>
> Since you see your problem slowly spreading across your machines, it may
> be you have some
> infestation that got in under the radar somehow and is messing with the
> permissions. I'd maybe try
> downloading something like AntiVir, which will (iirc) install and run in
> Safe Mode, to see if it picks
> anything up.
>
> --
Another sign of infection - everytime I reenable auto scan it falls back to
disabled.

Mike · External Since: Jul 26, 2007 Posts: 8

"Mike" wrote in message
>
> "foghollow" wrote in message
>
>> In article , says...
>>>
>>> frminst /forceuninstall (or frmpkg /forceuninstall) mean?
>>
>> You should have either frminst.exe or frmpkg.exe in one of the McAfee
>> folders. It's involved in the
>> installation of the McAfee Framework Service. Running it with the
>> /forceuninstall switch will remove
>> the framework, which may then allow you to uninstall the whole thing.
>> It's sometimes been found
>> with an un-/re-install that some of the framework files don't get deleted
>> in the un- and then don't
>> get overwritten in the re-, leaving a problem intact; the /forceuninstall
>> gets round that.
>>
>> Since you see your problem slowly spreading across your machines, it may
>> be you have some
>> infestation that got in under the radar somehow and is messing with the
>> permissions. I'd maybe try
>> downloading something like AntiVir, which will (iirc) install and run in
>> Safe Mode, to see if it picks
>> anything up.
>>
>> --
> I installed a June '07 version of AntiVir but could find an updated DAT to
> install. I ran the program but it did not find any virus.On two of the
> PCs before restarting they displayed the following error message - "floppy
> disk is infected remove disk" or something close to it.

no floppy disk was in the drive

David H. Lipman · External Since: Jul 04, 2003 Posts: 2245

From: "Mike"

|
| We have a license for v8.0i which I managed to install on another PC but
| same error message as above. It's infected.
| It's definitely infected. One of the error messages - error 1920. service
| network associates mcshield(mcshield) failed to start. verify that you have
| sufficient privileges to start system services, I was logged on as
| administrator when the error occured.
|

Download MULTI_AV.EXE from the URL --
http://www.pctipp.ch/downloads/dl/35905.asp

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file.

Additional Instructions:
http://pcdid.com/Multi_AV.htm

* * * Please report back your results * * *

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Mike · External Since: Jul 26, 2007 Posts: 8

"David H. Lipman" wrote in message

> From: "Mike"
>
>
> |
> | We have a license for v8.0i which I managed to install on another PC but
> | same error message as above. It's infected.
> | It's definitely infected. One of the error messages - error 1920.
> service
> | network associates mcshield(mcshield) failed to start. verify that you
> have
> | sufficient privileges to start system services, I was logged on as
> | administrator when the error occured.
> |
>
>
> Download MULTI_AV.EXE from the URL --
> http://www.pctipp.ch/downloads/dl/35905.asp
>
> To use this utility, perform the following...
> Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
> Choose; Unzip
> Choose; Close
>
> Execute; C:\AV-CLS\StartMenu.BAT
> { or Double-click on 'Start Menu' in C:\AV-CLS }
>
> NOTE: You may have to disable your software FireWall or allow WGET.EXE to
> go through your
> FireWall to allow it to download the needed AV vendor related files.

This is a specialized use network w/o Internet access. I need to d/l it to
a PC w/ Internet access then save it to a usb drive or other external device
then take the external device to the PC on the specialized network w/o
Internet access.
>
> C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
> This will bring up the initial menu of choices and should be executed in
> Normal Mode.
> This way all the components can be downloaded from each AV vendor's web
> site.
> The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and
> Reboot the PC.
>
> You can choose to go to each menu item and just download the needed files
> or you can
> download the files and perform a scan in Normal Mode. Once you have
> downloaded the files
> needed for each scanner you want to use, you should reboot the PC into
> Safe Mode [F8 key
> during boot] and re-run the menu again and choose which scanner you want
> to run in Safe
> Mode. It is suggested to run the scanners in both Safe Mode and Normal
> Mode.
>
> When the menu is displayed hitting 'H' or 'h' will bring up a more
> comprehensive PDF help
> file.
>
> Additional Instructions:
> http://pcdid.com/Multi_AV.htm
>
>
> * * * Please report back your results * * *
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>

David H. Lipman · External Since: Jul 04, 2003 Posts: 2245

From: "Mike"

|
| This is a specialized use network w/o Internet access. I need to d/l it to
| a PC w/ Internet access then save it to a usb drive or other external device
| then take the external device to the PC on the specialized network w/o
| Internet access.

Read the enclosed PDF Help File on how to use a surrogate PC to download signatures.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

foghollow · External Since: May 09, 2007 Posts: 33

In article , says...
>
> "Mike" wrote in message
> >
> > "foghollow" wrote in message
> >
> >> In article , says...
> >>>
> >>> frminst /forceuninstall (or frmpkg /forceuninstall) mean?
> >>
> >> You should have either frminst.exe or frmpkg.exe in one of the McAfee
> >> folders. It's involved in the
> >> installation of the McAfee Framework Service. Running it with the
> >> /forceuninstall switch will remove
> >> the framework, which may then allow you to uninstall the whole thing.
> >> It's sometimes been found
> >> with an un-/re-install that some of the framework files don't get deleted
> >> in the un- and then don't
> >> get overwritten in the re-, leaving a problem intact; the /forceuninstall
> >> gets round that.
> >>
> >> Since you see your problem slowly spreading across your machines, it may
> >> be you have some
> >> infestation that got in under the radar somehow and is messing with the
> >> permissions. I'd maybe try
> >> downloading something like AntiVir, which will (iirc) install and run in
> >> Safe Mode, to see if it picks
> >> anything up.
> >>
> >> --
> > I installed a June '07 version of AntiVir but could find an updated DAT to
> > install. I ran the program but it did not find any virus.On two of the
> > PCs before restarting they displayed the following error message - "floppy
> > disk is infected remove disk" or something close to it.
>
> no floppy disk was in the drive
>
Did you have a USB stick connected? The 'floppy' message /maybe/ refers to any removable device.
There are viruses that spread via an autorun on USBs.
--
Snob? Were I a snob, I wouldn't be talking to you.

foghollow · External Since: May 09, 2007 Posts: 33

In article , says...
>
> "foghollow" wrote in message
>
> > In article , says...
> >>
> >> frminst /forceuninstall (or frmpkg /forceuninstall) mean?
> >
> > You should have either frminst.exe or frmpkg.exe in one of the McAfee
> > folders. It's involved in the
> > installation of the McAfee Framework Service. Running it with the
> > /forceuninstall switch will remove
> > the framework, which may then allow you to uninstall the whole thing. It's
> > sometimes been found
> > with an un-/re-install that some of the framework files don't get deleted
> > in the un- and then don't
> > get overwritten in the re-, leaving a problem intact; the /forceuninstall
> > gets round that.
> >
> > Since you see your problem slowly spreading across your machines, it may
> > be you have some
> > infestation that got in under the radar somehow and is messing with the
> > permissions. I'd maybe try
> > downloading something like AntiVir, which will (iirc) install and run in
> > Safe Mode, to see if it picks
> > anything up.
> >
> > --
> Another sign of infection - everytime I reenable auto scan it falls back to
> disabled.
>
Not necessarily - this can be due to the way you installed VirusScan. It can reset settings to the
installation defaults at every boot, under some circumstances.
--
Snob? Were I a snob, I wouldn't be talking to you.

AmongstReality · Joined: Aug 18, 2007 Posts: 4