cancel
Showing results for 
Search instead for 
Did you mean: 

>.bup files in the quarantine folder

Jump to solution

I have over 15 thousand .bup files in my quarantine folder and can't erase them.  I thought McAfee was supposed to erase these files daily.  Also, when I go to my McAfee settings and click on help nothing happens.  The links are all dead.

1 Solution

Accepted Solutions
Highlighted

Re: >.bup files in the quarantine folder

Jump to solution

When a file gets quarantined it gets put into the quarantine folder and a .bup extension. If you have 15,000 .bup files, VirusScan has been doing its job and caught 15,000 things.

You can't go and delete them because Access Protection is doing its job protecting the McAfee folders.

To get rid of them:

Open your McAfee product by clicking the M icon on the desktop or near the system clock.

Click Navigation in the top right corner

Under Settings, Click General Settings and Alerts

Expand the Access Protection drawer and uncheck Use Access Protection

Click Apply

Leave Security Center open

On XP Open C:\documents and settings\all users\application data\mcafee\virusscan\quarantine

Delete all the .bup files

On Vista and Windows 7 Open C:\programdata\mcafee\virusscan\quarantine

Delete all the .bup files

Go back to Security Center and check Use Access Protection

Click Apply

Close Security Center

Regards,

Message was edited by: Doug Richards on 11/16/10 2:25:07 PM PST
14 Replies
Reliable Contributor exbrit
Reliable Contributor
Report Inappropriate Content
Message 2 of 15

Re: >.bup files in the quarantine folder

Jump to solution

.bup are Backup files from DVD images I believe, see Wikipedia, and to be there I guess VirusScan thought they were infected.  Those folders only empty at the 30 days mark as far as I know so best to empty manually before they get too full.

If the application is frozen I need to know what operating system this is.

Message was edited by: Ex_Brit on 16/11/10 4:03:49 CST PM

Re: >.bup files in the quarantine folder

Jump to solution

Thanks for the info but the answer below allowed me to delete them  I wasn't able to do it until I unchecked the USE ACCESS PROTECTION box.

I am using Windows XP and when I go the the McAfee Security Center to check my security settings the HELP and the McAfee Support Website links won't work.  I get nothing.

Highlighted

Re: >.bup files in the quarantine folder

Jump to solution

When a file gets quarantined it gets put into the quarantine folder and a .bup extension. If you have 15,000 .bup files, VirusScan has been doing its job and caught 15,000 things.

You can't go and delete them because Access Protection is doing its job protecting the McAfee folders.

To get rid of them:

Open your McAfee product by clicking the M icon on the desktop or near the system clock.

Click Navigation in the top right corner

Under Settings, Click General Settings and Alerts

Expand the Access Protection drawer and uncheck Use Access Protection

Click Apply

Leave Security Center open

On XP Open C:\documents and settings\all users\application data\mcafee\virusscan\quarantine

Delete all the .bup files

On Vista and Windows 7 Open C:\programdata\mcafee\virusscan\quarantine

Delete all the .bup files

Go back to Security Center and check Use Access Protection

Click Apply

Close Security Center

Regards,

Message was edited by: Doug Richards on 11/16/10 2:25:07 PM PST

Re: >.bup files in the quarantine folder

Jump to solution

Thanks, Doug.  It worked and now 58mb of files are gone.  BTW, some of these files dated as far back as May of this year.

epository
Level 10
Report Inappropriate Content
Message 6 of 15

Re: >.bup files in the quarantine folder

Jump to solution

Note:  you can submit these up to McAfee in the cases of false positives...

https://www.webimmune.net/

I am not claiming that submitting them actually does any good, but it appears the format is accepted and they do the auto-analysis.....

Waiting close to 24 hours for a false-positive response from McAfee right now, my bosses are less than pleased with their response time and the choice between a Virus Outbreak on our network vs. removing 600+ machines for a false-positive....

Seems like just a month or so ago, it was triggering on gsrs.js and it turned out to be a false-positive.

Well, McAfee.............we're waiting....................

Re: >.bup files in the quarantine folder

Jump to solution

Do you have the analysis ID? If you submit through the product you will get a response back to the email address from which you registered. In the case of potential false postives we need you to submit them to webimmune and then you need to give us the ID so we can flag it for deeper analysis. Otherwise the automation will detect your file and move on since it doesn't know it may be a false.

Regards,

Message was edited by: Doug Richards on 2/14/11 4:22:13 PM PST
epository
Level 10
Report Inappropriate Content
Message 8 of 15

Re: >.bup files in the quarantine folder

Jump to solution

Yes, I went out to the webimmune website and created and account there and tried to get some attention to it over 24 hours ago.

Today, I talked to the firewall personnel and was able to get the URL it was coming from so I provided that to McAfee as well.

I guess that wasnt enough so I googled and googled and saw that .bup files would be quarantined......out of desperation and my bosses asking me......are we under attack or is it a false positive, I submitted the .bup up to webimmune.

The only repsone I got was that it was a positive hit.  So now we will be 36 hours after initial report before I hear back from McAfee...

1.  Why isnt support or the webimmune site telling customers they can support .bup files????

2.  Where oh where on the webimmune site can you say you want to submit it as a false positive?????

3.  Why, 6 hours after the URL the infection allegedly came from was submitted..no one had bothered to go there....btw cbssports.com

4.  Why is the onus and heavy legwork always thrust down on the customer to show them that Mcafee has, once again, screwed up a DAT?

5.  How happy do you think my leadership is with a product that 1. cant seem to stop wiping out innocent files and setting off alarm bells and 2.  Provides you very unclear directions and avenues to submit your false-positives? 3.  After providing said info, drags its feet on support.....really, it should take us 48 hours to determine if we are under attack or bad DAT's have been put out again?   Thanks for another all-McAfee day trying to get answers and waiting and waiting and waiting...................

I know mcafee has no problem sucking Artemis info out of our network, why not this one?


So please show me where on the WebImmune site I can state its a false positive, and where on the WebImmune site it says go grab the .bup file from the customers computer. 

That is the most basic information McAfee should be providing instead of that ridiculous collect code/zip it/password it/mail it.......etc.  Its your Freaking product, show some interest in not repeating the lsass debacle from last year!!!!!!

Re: >.bup files in the quarantine folder

Jump to solution

I really can't do anything without an Analysis ID.

Re: >.bup files in the quarantine folder

Jump to solution

Additionally you can reference this article to submit a potential false https://kc.mcafee.com/corporate/index?page=content&id=KB67411

Reference this article to properly submit your sample. https://kc.mcafee.com/corporate/index?page=content&id=KB68030

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community