On Access Scanner disabled and greyed Out

[minied69]

Hi,

My On-Access Scanner and Access Protection has been disabled. I cannot enable them again because they are greyed out. I tried reinstall the software, it works fine after install. When I update Data File, it gets disabled and greyed out again. I am using McAfee antin Virus Ver 8.8 with latest dat file.

Please help me solve this problem asap as my machine is prone to intrusion without ON Access Scan since I am on internet a lot. I already found some trojans and removed. Also done STinger in sfae mode, rootkitremover and getsusp. All show no errors anymore.

Please advice.

[andyross]

Does a reboot re-enable it?

[ankedia]

I have the same issue which started on Saturday. Multiple attempts to reboot and re-enable it didn't work. I also ran McAfee stinger, malwarebytes scan and ComboFix. It found and removed some malwares. However none of them has helped in fixing this issue. Besides I got an error "Optional update delivery is not working". Could it be some new virus causing this issue?

Thanks in advance

[alexn]

Hi, Emergency help for you

1.check these services whether runing or not.

McAfeeFramework

McShield

McTaskManager

mfevtp

2.Check for any other AV software in contrl pannel, installed directory or look for any stealth process running in your PC, causing conflict.

Lem me know asap.

[ankedia]

All services are running except McShield. McShield is paused and all options start/stop/resume/pause/restart are greyed out. In other words, McShield service can't be started. I didn't see any stealth process running and conflicting on my PC.

Thanks.

[minied69]

Hi Alexn,

A reboot does not enable it. There are no other stealth AV running. Here are the Services status:

The one which are not started when I try to start them manually they say they are dependant on MCAfee Validation Trust PRotection Service. When I try to start this service, it says its dependant on McAfee Inc. mfehidk. I cant find this service anywhere.

Message was edited by: minied69 on 2/27/13 6:38:26 PM CST

[alexn]

Hi  ankedia and minied69,

Open VSE console>Double click Access Protection and at the bottom of this window >uncheck "prevent mcafee services from being stopped">click OK.

OPen services again right click  these three services and see whether do you see option to restsrt them or not.

McAfeeFramework

McShield

McTaskManager

As far as Mcafee trust validation services is concerend (mfevtp), you will not see any option to stop or resrts it, this services uses Microsoft crpytographic APiz to validate whethet all mcafee process are loading McAfee and Microsoft files only.This is the services who guards all mcafee process.

After restarting all three services, again open vse console and "check" prevent mcafee services from being stopped" click ok.

if it doesnt resolve your issue then please lem me know what other mcafee products are you having on these machines with version and patch info.

also mention 8.8 patch version as well?

[minied69]

Hi Alexn,

The option to uncheck is greyed out. Below info on my McAfee (x-ed out Network Identity) :

System Information 

McAfee Host Intrusion Prevention 

Version number: 8.0

Build date: Thursday, September 08, 2011

Build Number: 8.0.0.1919

License Type: Licensed

Expiration Date 

Language: English

Security Content Version: 8.0.0.3896

Patch: 1

McAfee Agent 

Version number: 4.6.0.2935

Managed 

Last security update check: 2/28/2013 9:29:06 AM

Last agent-to-server communication: 2/28/2013 7:58:33 AM

Agent to Server Communication Interval (every): 6 hours

Policy Enforcement Interval (every): 30 minutes

Agent ID: XXXXXXX
ePO Server/Agent Handler 

DNS Name: XXXXXX
IP Address: XXXXXXXX

Port Number: 443

DNS Name: XXXXXX

IP Address: XXXXXX

Port Number: 443

DNS Name: XXXXXX

IP Address: XXXXXX

Port Number: 443

McAfee Endpoint Encryption Agent 

Version number: 1.1.3

Language: Multiple

McAfee EEGO 

Version number: 1.0.0.10

Language: Multiple

Endpoint Encryption for PC 

Version number: 6.1.3.7409862

McAfee VirusScan Enterprise + AntiSpyware Enterprise 

Version number: 8.8.0 (8.8.0.975)

Build date: 8/14/2012

Anti-virus License Type: licensed

Scan engine version (64-bit): 5400.1158

DAT version: 6998.0000

DAT Created on: 2/26/2013

Number of Signatures in extra.dat: 0

Name of threats that extra.dat can detect: None 

Buffer Overflow and Access Protection DAT version: 589

Installed Patches: 2

Installed Modules: 

Copyright © 1995-2012 McAfee, Inc. 

All Rights Reserved. 

www.mcafee.com 

[minied69]

Gave up, reimaged machine. Thanks for the help.

[alexn]

Hi,

minied69,

Thanks for providing all these info, your machine is being managed with ePO, whatever I mentioned above, you will find all these settings under VSE policies in ePO.So for future references, you can change or apply any policy for any machine from epo, and "Prevent Mcafee services from being stopped" you can find this settings for your machines under vse policies in epo.

Regd.