McAfee File Lock Blocked by Group Policy

[robsoti]

Yes looks like I messed things up again. I updated JAVA to latest version.

IE still looked sluggish and always opens up with a message saying that some program has corrupted the search engine and that it is defaulting to bing.

I went to the Programs/Features to uninstall/reinstall IE8. When I clicked on it, it just disappeared. No messages. No nothing. Good thing I got chrome. Good thing the McAfee udpated (manually) tonight. Nothing going right on this machine.

[robsoti]

McAfee on laptop is still doing updates, scans, and other basic things necessary for antivirus. Gui interfaces have not changed. I may just close this post, since it is running in a basic mode. I use Chrome, so I am not going to update IE just this moment. Takes too much time (slow DSL) and I do have a day job. Not sure what is going on.

[selvan]

Hi robsoti,

At this point I would like to check for any infections on the machine. You could run getsusp from getsusp.mcafee.com and Stinger from stinger.mcafee.com. Post back if they pick up something..!

[robsoti]

I was apparently able to download the latest definitions yesterday (or so it said) although the ABOUT tab does not work and I cannot confirm this. I have run a full scan twice, first time it quarentined a temp file from the internet, second time it found nothing. If all else fails, I will see what GETSUPD and STINGER do.

[robsoti]

Selvan,

output from Stinger:

Selvan:

Stinger output:

C:\ProgramData\Microsoft\{8a64de72-585f-da3d-248a-d7e90408ccb8}\{8a64de72-585f-d a3d-248a-d7e90408ccb8}.exe [MD5:fe1a01904824f55d9b12b6e3c5fe7e48] is infected with Artemis!FE1A01904824

C:\ProgramData\Microsoft\{8a64de72-585f-da3d-248a-d7e90408ccb8}\{8a64de72-585f-d a3d-248a-d7e90408ccb8}.exe couldn't be repaired

C:\ProgramData\Microsoft\{8a64de72-585f-da3d-248a-d7e90408ccb8}\{8a64de72-585f-d a3d-248a-d7e90408ccb8}.exe [MD5:fe1a01904824f55d9b12b6e3c5fe7e48] is infected with Artemis!FE1A01904824

C:\ProgramData\Microsoft\{8a64de72-585f-da3d-248a-d7e90408ccb8}\{8a64de72-585f-d a3d-248a-d7e90408ccb8}.exe couldn't be repaired

I was able to delete this directory and file after Stinger tried to quarentine it. Rebooted and reran Stinger. It didn't find anything else. Interesting that this didn't show up in the McAfee full virus scan.

Getsupd output:

Suspicious Files

Status	MD5	Location	File Name	Attribute	Company	Description	Product Version	File Version	File Size	Creation Date	Modification Date	Type	Scan Error
Invalid-DS	373f28044cd61423799d9c60b6f1fc15	C:\PROGRAM FILES (X86)\COMMON FILES\COMMON DESKTOP AGENT	CDASRVPS.DLL	A		CDA proxy/stub DLL	1.62.0.0	1.62.0.0	56,696	03/09/2012 08:58	03/09/2012 08:58	Prefetch
Invalid-DS	b1964e8776fd7633f149788f5b2a71cb	C:\Program Files\Common Files\Common Desktop Agent	CDASrv.exe	A		CDA Server	1.62.0.0	1.62.0.0	462,712	03/09/2012 08:58	03/09/2012 08:58	Windows-Firewall
UNKNOWN	dde300af978d775952e191ec185e49d9	C:\Users\Diane\AppData\Roaming\Sens2apiARM	Sens2apiARM.dll	A					32,768	07/14/2013 08:41	07/14/2013 08:41	Run-Key
UNKNOWN	44eefd7253cbbd7fa6e493eafd3e026c	C:\Program Files (x86)\Dell\Dell B1160w Mono Laser Printer\TORDER	uninstall.exe	A	Dell Inc.	Dell Inc.	1.03.10.00	1.03.10.00	248,665	06/14/2014 07:32	06/14/2014 07:32	Windows-Firewall
UNKNOWN	7390b7209ceda2cd6316b9a2bff7ac84	C:\Program Files (x86)\Dell\Dell Printer Manager	uninstall.exe	A	Dell Inc.	Dell Inc.	01.03.10.00(2013.03.11)	1.03.10.00	869,152	06/14/2014 07:31	06/14/2014 07:31	Windows-Firewall

Unknown Files

Status	MD5	Location	File Name	Attribute	Company	Description	Product Version	File Version	File Size	Creation Date	Modification Date	Type
UNKNOWN	2f3d353b93ffbccb8b8b497a1a05296b	C:\PROGRAM FILES (X86)\DELL\DELL PRINTER MANAGER	IDS.OEMFRAMEWORK.DLL	A	Dell Inc.	A framework for OEM development	01.03.10.00	01.03.10.00	130,560	03/11/2013 04:01	03/11/2013 04:01	Prefetch
UNKNOWN	f9b8abc3f964ce5f099d1140023f78da	C:\PROGRAM FILES (X86)\DELL\DELL PRINTER MANAGER	IDS.XMLPARSER.DLL	A	Dell Inc.	XML Parser Module	01.03.10.00	01.03.10.00	55,296	03/11/2013 04:01	03/11/2013 04:01	Prefetch

Not sure what common desktop agent or the sens2apiarm are. Common desktop agent has been there since June 14, and I know things have worked since then. The other one has been in place sinceJuly 2013 and I know things have been fairly stable until this past Friday.

Still have the following issues after reboot:

1. "ABOUT" still does not work.

2. FILE LOCK generates a "blocked due to group policy" statement.

3. Cannot use Programs/Features "uninstall/change" feature on McAfee Total Protection, as it generates an insufficient access error.

Again, I verified on the hard drive that McAfee virus def was updated yesterday at 4:14pm. And full virus scans have come up fine. I believe that the ABOUT tab was not functioning Prior to my updating the virus definitions. There was a Microsoft update to SILVERLIGHT prior to this. But I cannot back that update out. No system restore point available.