VirusScan 8.7 Disabling Itself

[arhantivirus!]

Is anyone else getting machines with VS8.7 (with and without patch1) disabling itself automatically. Getting a large amount of machines which seem to be having the issue, some times seen after the installation of HIPS. Unable to start the service and when you go to uninstall VS8.7 it doesn't appear in add/remove programs?

Thanks.

[PhilR]

That's possibly this nasty:

https://kc.mcafee.com/corporate/index?page=content&id=KB65940

"Problem 1

When trying to install Patch 1 for VirusScan Enterprise 8.7i on McAfee Host Intrusion Prevention (HIP) 7.0 client running build 7.0.0.976 (Patch 4) or lower, the following error is reported:

Error 1920: Service McAfee McShield failed to start. Verify that you have sufficient privileges to start system services.

Problem 2

Installation of Patch 1 for VirusScan Enterprise 8.7i is triggering Host IPS Signature 1001 violations on mfehidin.exe

Patch 1 for VirusScan Enterprise 8.7i fails to install on computers which have McAfee HIP 7.0 Agent for Windows (Patch 4 or lower) installed (HIP client systems) with IPS protection enabled (PREVENT - HIGH). This issue occurs with HIP content version 2616 or before."

"Cause

This is due to a missing internal exception for the Mcafee VSE mfehidin.exe. Critical updates during the VSE installation are blocked by the HIP agent shielding signature 1001.

Solution

This issue will be resolved in the HIP June content update of 9 June, 2009.

Workaround

Create an IPS exception for mfehidin.exe from the Host IPS event."

If it isn't HIPS, 8.7i without Patch 1 has a habit of doing this; patch 1 is supposed to fix it.

[jawuk]

I knew it!

http://forums.mcafeehelp.com/showpost.php?p=564875&postcount=65

[arhantivirus!]

Thanks for the reply. Not happy! It's also happening with VS8.7 unpatched! McAfee apps blocking McAfee apps! Problem is HIPS then goes wrong and it's a visit to the machine!

It seems the more advanced the McAfee apps get the more problems there are! Never used to have problems like this when using older versions.

:mad:

[PhilR]

HIPS is a total nightmare. The standard corporate network templates block loads of legitimate (i.e. necessary) corporate network type traffic.

V7 Patch 4 still looks like V0.7 alpha 4 to me in terms of quality.

And management of it is a real *****.

Arrrrgh!

Phil

[jawuk]

I cant say i have had many issues with HIPS so far to be honest as far as the product goes, but the issue with not being able to deploy 8.7 or 8.7p1 AND as i have tried, 8.5, while it is installed and enabled, is a joke.

Another thing that McAfee have not considered is, although the issue may be fixed with a DAT update to the HIPS definitions, the standard install package does not include the newest definitions on the first installation from the server to client, so if you have a task setup to install HIPS and then install AV, and it has not had a chance to update its dats before it kicks of the VS install job, then surely it will fail also.

The HIPS package IMHO needs to be re-posted with this fix in the package you check in to EPO, so it works from the get go.

[arhantivirus!]

Almost like apps are being released without testing!

I think VS8.7 and HIPS is also slowing the machines down at startup. Users are going mad when using laptops off-line at home. Taking 15 minutes in some cases from pressing the on button to getting to desktop start menu.