VirusScan OnAccess Scanner not getting enabled

[suman_rak]

I have been performing R&D from long time on this issue. But, did not achieve any success. VirusScan OAS is in disabled state for many machines. And when I unlock the VSE console and try to enable OAS, it does not gets enabled. Did everything from stopping services to disabling Access Protection. Nothing works except for a VSE reinstallation which I the last option I wanna do.

Someone, please suggest ways to remediate this issue. What might cause this weird behavior?

Thanks in advance!

[system48]

Can you check the value of a registry key on one of these systems? 

32-Bit OS

Location: HKLM\Software\McAfee\DesktopProtection

Key: OASState

64-Bit OS

Location: HKLM\Software\Wow6432Node\McAfee\DesktopProtection

Key: OASState

[suman_rak]

Hi System48,

The value for OASState is 2.

[ansarias]

Try to redeploy VSE from ePO console on some machines and add below command under command line in deployment task.

REINSTALLMODE=amus /q (Install both program and registry files)

[suman_rak]

I dont want to redeploy VSE. I want this as the last option. Need to know the root cause behind this issue which I am unable to find.

[ansarias]

OAS was disable automatically or it was happen after upgrade?

When it was working perfectly.

[suman_rak]

It was disabled automatically. Not after the upgrade

[system48]

Do you have the access protection policy enabled for McAfee processes, files and registry settings?

[gajendrakalure]

Resolved for me

I was facing similar issue on windows 2003 server.  I removed VSE 8.8 and redployed. but getting OAS disabled.Aslo tried deleting McShied service.but no luck. Finally, I modiefied registry entry as below

HKLM\Software\McAfee\DesktopProtection

OASState=3

this enabled the ON Access Scanner in windows 2003 server.

[llamamecomoquie]

Morning suman,

You could run the McAfee getsusp and see if the Machine could be infected.

To download the getsusp go to:

http://www.mcafee.com/es/downloads/free-tools/getsusp.aspx

If you do not know how to interpretate the logs just upload it in here and we can check it.

Best regards,

Jose