Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
2410 Views 8 Replies Latest reply: Jan 5, 2012 12:35 PM by mx6bfast RSS
mx6bfast Newcomer 5 posts since
Dec 27, 2011
Currently Being Moderated

Dec 27, 2011 2:22 PM

Got a virus and now McAfee wont update

Got a virus a few weeks ago and was able to get rid of it. I can't remember the name of it but it hid all of my files/folders and have slowly but surely been unhiding them.

 

Since them I have uninstalled/reinstalled McAfeee multiple times, run the program to completely remove all McAfee everything, and I still can't get McAfee to update on its own. I have called my corporate tech support line and got pretty much no help from them. I have just been installing the superdat file every 10 days or so so I can continue to VPN in. There is a new superdat today but my update didn't install it. Usually the console will say Update succeeded, but when I bring up About McaAfee it doesn't have a new dat file mentioned on it.

 

Here is the log that I usually see:

 

12/27/2011    2:00:35 PM    CORP\439577    Starting task: AutoUpdate

12/27/2011    2:01:54 PM    CORP\439577    Checking update packages from repository NAIFtp.

12/27/2011    2:01:54 PM    CORP\439577    Initializing update...

12/27/2011    2:01:54 PM    CORP\439577    Verifying catalog.z.

12/27/2011    2:01:54 PM    CORP\439577    Extracting catalog.z.

12/27/2011    2:01:54 PM    CORP\439577    Loading update configuration from: catalog.xml

12/27/2011    2:01:55 PM    CORP\439577    These updates will be applied if they are in the repository:  Engine, DAT, VSCANCEU1000, EXTRADAT1000, BOCVSE__1000, VIRUSCAN8700.

12/27/2011    2:01:55 PM    CORP\439577    Downloading PkgCatalog.z.

12/27/2011    2:01:56 PM    CORP\439577    Verifying PkgCatalog.z.

12/27/2011    2:01:56 PM    CORP\439577    Extracting PkgCatalog.z.

12/27/2011    2:01:56 PM    CORP\439577    Loading update configuration from: PkgCatalog.xml

12/27/2011    2:01:58 PM    CORP\439577    Verifying V2engdet.mcs.

12/27/2011    2:01:58 PM    CORP\439577    Product(s) running the latest Engine.

12/27/2011    2:01:58 PM    CORP\439577    Downloading PkgCatalog.z.

12/27/2011    2:01:59 PM    CORP\439577    Verifying PkgCatalog.z.

12/27/2011    2:01:59 PM    CORP\439577    Extracting PkgCatalog.z.

12/27/2011    2:01:59 PM    CORP\439577    Loading update configuration from: PkgCatalog.xml

12/27/2011    2:02:00 PM    CORP\439577    Verifying V2datdet.mcs.

12/27/2011    2:02:01 PM    CORP\439577    Downloading PkgCatalog.z.

12/27/2011    2:02:02 PM    CORP\439577    Verifying PkgCatalog.z.

12/27/2011    2:02:02 PM    CORP\439577    Extracting PkgCatalog.z.

12/27/2011    2:02:02 PM    CORP\439577    Loading update configuration from: PkgCatalog.xml

12/27/2011    2:02:03 PM    CORP\439577    Starting DAT update.

12/27/2011    2:02:04 PM    CORP\439577    Downloading DAT.

12/27/2011    2:02:38 PM    CORP\439577    Generic script error.

12/27/2011    2:02:38 PM    CORP\439577    Verifying BocDet_VSE.McS.

12/27/2011    2:02:38 PM    CORP\439577    Searching available updates for BOC DAT.

12/27/2011    2:02:38 PM    CORP\439577    Downloading PkgCatalog.z.

12/27/2011    2:02:39 PM    CORP\439577    Verifying PkgCatalog.z.

12/27/2011    2:02:40 PM    CORP\439577    Extracting PkgCatalog.z.

12/27/2011    2:02:40 PM    CORP\439577    Loading update configuration from: PkgCatalog.xml

12/27/2011    2:02:40 PM    CORP\439577    Product(s) running the latest BOC DAT.

12/27/2011    2:02:41 PM    CORP\439577    Verifying VSE870Det.McS.

12/27/2011    2:02:41 PM    CORP\439577    Searching available updates for McAfee VirusScan Enterprise 8.7.0.

12/27/2011    2:02:41 PM    CORP\439577    The following packages were not in the repository:  VSCANCEU1000, EXTRADAT1000.

12/27/2011    2:02:41 PM    CORP\439577    Update Finished

 

I did this kb article, https://kc.mcafee.com/corporate/index?page=content&id=KB66848, and I didn't get teh Generic Script Error, but the update still failed.

 

12/27/2011    2:13:28 PM    CORP\439577    Starting task: AutoUpdate

12/27/2011    2:15:41 PM    CORP\439577    Checking update packages from repository CTC FTP.

12/27/2011    2:15:41 PM    CORP\439577    Initializing update...

12/27/2011    2:15:41 PM    CORP\439577    Downloading catalog.z.

12/27/2011    2:16:28 PM    CORP\439577    Verifying catalog.z.

12/27/2011    2:16:28 PM    CORP\439577    Extracting catalog.z.

12/27/2011    2:16:28 PM    CORP\439577    Loading update configuration from: catalog.xml

12/27/2011    2:16:29 PM    CORP\439577    These updates will be applied if they are in the repository:  Engine, DAT, VSCANCEU1000, EXTRADAT1000, BOCVSE__1000, VIRUSCAN8700.

12/27/2011    2:16:29 PM    CORP\439577    Downloading PkgCatalog.z.

12/27/2011    2:17:03 PM    CORP\439577    Verifying PkgCatalog.z.

12/27/2011    2:17:03 PM    CORP\439577    Extracting PkgCatalog.z.

12/27/2011    2:17:03 PM    CORP\439577    Loading update configuration from: PkgCatalog.xml

12/27/2011    2:17:04 PM    CORP\439577    Verifying V2engdet.mcs.

12/27/2011    2:17:04 PM    CORP\439577    Product(s) running the latest Engine.

12/27/2011    2:17:04 PM    CORP\439577    Downloading PkgCatalog.z.

12/27/2011    2:20:56 PM    CORP\439577    Error occurred while downloading C:\ProgramData\McAfee\Common Framework\Current\VSCANDAT1000\PkgCatalog.z.

12/27/2011    2:20:56 PM    CORP\439577    Verifying BocDet_VSE.McS.

12/27/2011    2:20:56 PM    CORP\439577    Searching available updates for BOC DAT.

12/27/2011    2:20:56 PM    CORP\439577    Downloading PkgCatalog.z.

12/27/2011    2:22:01 PM    CORP\439577    Error occurred while downloading C:\ProgramData\McAfee\Common Framework\Current\BOCVSE__1000\DAT\0000\PkgCatalog.z.

12/27/2011    2:22:01 PM    CORP\439577    Verifying VSE870Det.McS.

12/27/2011    2:22:01 PM    CORP\439577    Searching available updates for McAfee VirusScan Enterprise 8.7.0.

12/27/2011    2:22:01 PM    CORP\439577    Product(s) running the latest HotFix 4.

12/27/2011    2:22:01 PM    CORP\439577    The following packages were not in the repository:  DAT, VSCANCEU1000, EXTRADAT1000.

12/27/2011    2:22:01 PM    CORP\439577    Update Finished

 

Any thoughts?

 

I also can't run a Windows Update since the virus too.

 

Message was edited by: mx6bfast on 12/27/11 2:22:35 PM CST
  • k3tg Veteran 870 posts since
    May 22, 2007
    Currently Being Moderated
    1. Dec 27, 2011 3:53 PM (in response to mx6bfast)
    Re: Got a virus and now McAfee wont update

    Moved thread from Home Office  Products to Virus Scan Enterprise for attention.

     

    on 12/27/11 4:53:34 PM EST

    Tom K3TG

    Volunteer Moderator
  • Attila Polinger Veteran 1,161 posts since
    Dec 8, 2009
    Currently Being Moderated
    2. Dec 28, 2011 6:41 AM (in response to mx6bfast)
    Re: Got a virus and now McAfee wont update

    Hi,

     

    please if you took a look at KB58966 and perform  what is therein, you could see the result in McScript.log, which would tell you about the cause in more detail.

     

    Attila

  • Regis Champion 457 posts since
    Oct 6, 2010
    Currently Being Moderated
    3. Dec 28, 2011 7:47 AM (in response to mx6bfast)
    Re: Got a virus and now McAfee wont update

    Sorry to hear of your malware infection.

     

    This may not be the answer to the question you asked, but since you're in the Enterprise forum, someone needs to break you the bad news.

     

    In  companies who are doing this to best practices,  once you had a confirmed malware infection, your box would have been rebuilt from a fresh and trusted image long before you went through even a 2nd mcafee reinstallation.   Basically, once you have a confirmed malware infection, that machine can't be trusted again, even if a malware program claims to have removed the infection.     An AV program can claim to have removed the issue, but AV programs only know about the malware they have a signature for and removal instructions for. 

     

    The downloading of the update is what seems to be failing.  If you were really interested in debugging that, using wireshark to sniff the network traffic on that host to see what it's talking to would be worthwhile.  I'd probably also check the hosts file to see if it was monkeyed with with the malware infection and is perhaps interfering with the download.  But I wouldn't waste any more time on what could be a wormhole that at best will leave you with a machine you still can't entirely trust.  Your time would be much better spent on re-imaging the machine.

     

    I wish I had better news.  Good luck.

  • Attila Polinger Veteran 1,161 posts since
    Dec 8, 2009
    Currently Being Moderated
    6. Dec 29, 2011 12:26 AM (in response to mx6bfast)
    Re: Got a virus and now McAfee wont update

    Loglevel key can be accessed once you temporarily disable Access Protection module, since the rules for preventing programs to modify McAfee files and settings may be active. When you set LogLevel, you can enable AP again.

    I strognly recommend performing this procedure in KB in its entirety when you encounter some unexplicable error in McAfee Agent operation again. Doing any network sniffing might be useful for cases but not in any of them in which non-network related issues prevent some operation.

     

    A typical issue with update could be the lack of free space in, or existence of, the temp folder, which is used to download files to during an update.

     

    Attila

  • pierce Champion 402 posts since
    Feb 22, 2011
    Currently Being Moderated
    7. Jan 5, 2012 10:58 AM (in response to Regis)
    Re: Got a virus and now McAfee wont update

    I agree with Regis, any detection that is remotely difficult to get rid (as in McAfee didnt clean it) you should take this machine off the network and rebuild it from scratch. We can rebuild a laptop in a few hours and it sounds like that has been going on for weeks which is a big drain on your time im sure!

     

    It also makes your end users know to use proper backup procedures and be more careful on the internet if they know that any issues with their machines and they are getting a clean one back.

     

    thanks,

    Pierce

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points