I'm having an issue with our new batch of PCs for my company. They're HP slimlines running Windows XP that we picked up for a good price, and now I'm getting them all prepped for release. That includes putting McAfee VirusScan Enterprise 8.70i on them.
The install goes just the same as usual, and seems to work fine. The agent installs, it connects to the ePO server, and downloads the engine. Everything seems to go fine, and no errors are generated.
However, after everything installs, the McAfee icon on the taskbar has a red circle with a slash through it. Hovering my mouse over it indicates tells me "McAfee OAS: Disabled". The Enable button is grayed out. I run the agent status monitor, and tell it to enforce policies, and the red circle disappears for a moment - and then shows back up again. I went into the Windows service manager to manually run MCShield, and got the following error: "The McAfee McShield service on Local Computer started and then stopped. Some services stop automatically if they have no work to do, for example, the erformance Logs and Alerts service."
I know the policy is right, since it's the same one all the other PCs are using. It's getting updates just fine. The only thing I can think of is that there's something already installed on the PC that's interfering with the service. Any ideas?
Here's the HijackThis log for the PC.
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:18:49 AM, on 4/27/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16827) Boot mode: Normal
The current Engine/DAT seem have a problem starting or communicating with the drivers. You can see the error code of 8 meaning a problem loading the DATs in the Application log under the source McLogEvent.
For the time being, many of us are recommending to go back to Engine 5300.