1 2 Previous Next 10 Replies Latest reply on Aug 10, 2009 6:13 AM by Peter M

    Real-time scanning (Virus Prot) Stop auto delete

      Hello,

      I would like to know if there is any option available to stop the auto deleting of a virus or Trojan since not all files that McAfee detects are actually those and it is not like it goes into the recycling bin where you can just recover those files. It is quite annoying when you just go into a folder and an file is deleted before you can do anything about it.

      Thanks for any help even if there is no option available.
        • 1. I also have the same problem
          Hi...I am a Systems Security Specialist and I frequently have to analyze infected files or possibly infected files. I also have to work with a NUMBER of files which are false positive for Trojans.
          I find that McAfee Realtime scanner automatically deletes these files without asking for confirmation.

          Could you please tell me a way as I am really desperate that these files are getting deleted without confirmation from me!

          I am an user of McAfee from 1988 or so, from the DOS days...For many years there used to be confirmation asked from the scanner before deleting files.But its no longer available...

          Could you please let me know of SOME way to avoid this or for it to exclude certain folders or files. The only other alternative I see is to stop using McAfee and I love it too much to stop using it :-(

          Thank you...
          • 2. RE: I also have the same problem
            Vinod R


            I wonder why a professional would like to use a consumer version of a product.. this software is intended for use for average home users .:)

            If you want lot of customizations etc.. perhaps you might want to consider an Enterprise product..

            On consumer products killing the McAfee related processes would terminate the process but its not advised and this might not work from a script or automation due to the built in protection.
            • 3. Thanks ...but...
              Thank you for the quick answer.
              My company uses Symantec Norton Corporate AV and this has a facility to exclude certain folders and files from the scanner.

              It's only when I return home and bring the files I want to work with on my Pen drive and plug it in, that I realize, to my utter frustration that the files are already deleted.

              I am using the McAfee 10-in-1 security product on my home computers. But presently I am forced to switch off the AV when I am working with these files. I am not at all happy with the idea, for obvious reasons!

              Could you please direct me to specific products or solutions so that I can achieve my goal WITHOUT having to stop using the McAfee...

              I tried direct registry editing to place some files in the Exclusion Lists but it appears that the scanners also stores it in a file somewhere else, in encrypted form, as to what files to exclude.

              I am utterly frustrated. I would be extremely grateful if a solution could be found without me having to stop using McAfee...

              Would using any older versions of McAfee help...?I have most of the old versions also..
              Thanks...
              • 5. RE: Real-time scanning (Virus Prot) Stop auto delete
                I already followed the guide-lines...Turned Artemis off but still the scanner keeps on deleting files...The files I have to inspect are mostly those that DO contain malware of some sort. Sometime they are keygens etc which I require to reverse, in the course of my study...Hence there is no point in me sending them off to you all for analysis, as they are infected files of some sort.

                What I DO require is some way where the scanner alerts me that it contains trojan, and I just tell the scanner to ignore it, while I keep the file somewhere in some folder.

                I do the actual running (execution) of the file, during reversing, in a Virtual Machine. So I don't want the scanner deleting the file well before I copy it from my pen drive to the hard disk!

                The previous versions of McAfee had this very useful feature where it would have a setting in the Options to "Ask before deleting or cleaning" files.

                Please point me in the right direction and advise whether installing any older versions of McAfee would put my computer at risk. I understand that the Engine of the scanner would still upgrade itself to the lastest one even if I install any older version. Please tell me if this is true.

                Also please advise whether McAfee Enterprise edition v8.0 would have this facility...

                Was very frustrated since yesterday suddenly the scanner deleted a folder full of exe files I had generated using the battoexe program, from bat files.

                The scanner was fine with them till yesterday. Just yesterday, suddenly it decided that the files contained a trojan and deleted them. It also deleted a backup of them which I was having on my hard drive for the past few months. SO am sure they are not infected!
                The same signature strings could be possibly be in use by other malware apps!

                Thank you...What I am finally looking is for a way to exclude certain folders on my drive permanently from the scanner...!
                • 6. RE: Real-time scanning (Virus Prot) Stop auto delete
                  Peter M
                  Ah now we are talking about a different issue. The ability to ignore files was last seen in VirusScan 9 several years ago and despite requests they never brought it back.

                  To stop the detection of certain files you would have to submit them as per this sticky:
                  http://community.mcafee.com/showthread.php?t=228162
                  • 7. RE: Real-time scanning (Virus Prot) Stop auto delete
                    The problem would be that they won't exclude the files if I send them to the above URL if the file IS a malware or if can be used for malicious purposes isn't it?

                    For example, I do require to use Cain and Abel file for auditing purposes now and them. But the AV screeches and squaks and deletes the file well before it even commences to land onto the HDD from the pen drive...

                    In such cases what do I do..? Will the submission of the file to the above URL help? I think not, isn't it...

                    Many other files used for Network and Local Security Auditing invokes such responses...

                    Pls advise...Also will installing McAfee v9 that you mentioned above, help? I have a feeling that once it updates itself on the internet to v13, again the proble will return...

                    Can you please suggest a good solution? I am otherwise too happy with McAfee and having been using it for so many years that I hate to give it up!

                    Thank you...
                    • 8. RE: Real-time scanning (Virus Prot) Stop auto delete
                      Peter M
                      If they reject an application reply immediately appealing the decision with an explanation. Sometimes they will make exceptions.
                      • 9. RE: Real-time scanning (Virus Prot) Stop auto delete
                        Either way, the bottom line is there is no current function nor reg change that can be done to allow that alert and choice to delete or not delete the supposed bad file correct?

                        This was the main concern and if the only partial solution is to allow certain files access so they are not deleted, than this is still useless and a nuisance as we would have to do that more times than just turning off the real-time scan function.

                        Thanks for trying to help though Ex.

                        No need to go on further with this thread unless some new way is found =)
                        1 2 Previous Next