1 2 3 Previous Next 20 Replies Latest reply on Apr 5, 2010 8:26 AM by lowlyenduser

    Outlook causing access protection error?

    andyross

      Since yesterday's (March 16) update, Enterprise 8.5 on my computer started logging this:

       

      3/16/2010    3:07:52 PM    Blocked by Access Protection rule     TFGNY\Andy    D:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE    \REGISTRY\MACHINE\SOFTWARE\McAfee\AVEngine\EngineVersionMajor    Common Standard Protection:Prevent modification of McAfee Scan Engine files and settings    Action blocked : Create
      3/16/2010    3:07:52 PM    Blocked by Access Protection rule     TFGNY\Andy    D:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE    \REGISTRY\MACHINE\SOFTWARE\McAfee\AVEngine\EngineVersionMinor    Common Standard Protection:Prevent modification of McAfee Scan Engine files and settings    Action blocked : Create
      3/16/2010    3:07:52 PM    Blocked by Access Protection rule     TFGNY\Andy    D:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE    \REGISTRY\MACHINE\SOFTWARE\McAfee\AVEngine\AVDatVersion    Common Standard Protection:Prevent modification of McAfee Scan Engine files and settings    Action blocked : Create
      3/16/2010    3:07:52 PM    Blocked by Access Protection rule     TFGNY\Andy    D:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE    \REGISTRY\MACHINE\SOFTWARE\McAfee\AVEngine\AVDatDate    Common Standard Protection:Prevent modification of McAfee Scan Engine files and settings    Action blocked : Create
      3/16/2010    3:07:52 PM    Blocked by Access Protection rule     TFGNY\Andy    D:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE    \REGISTRY\MACHINE\SOFTWARE\McAfee\AVEngine\TrjDatVersion    Common Standard Protection:Prevent modification of McAfee Scan Engine files and settings    Action blocked : Delete
      3/16/2010    3:07:52 PM    Blocked by Access Protection rule     TFGNY\Andy    D:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE    \REGISTRY\MACHINE\SOFTWARE\McAfee\AVEngine\TrjDatDate    Common Standard Protection:Prevent modification of McAfee Scan Engine files and settings    Action blocked : Delete
      3/16/2010    3:07:52 PM    Blocked by Access Protection rule     TFGNY\Andy    D:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE    \REGISTRY\MACHINE\SOFTWARE\McAfee\AVEngine\PUPDatVersion    Common Standard Protection:Prevent modification of McAfee Scan Engine files and settings    Action blocked : Delete
      3/16/2010    3:07:52 PM    Blocked by Access Protection rule     TFGNY\Andy    D:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE    \REGISTRY\MACHINE\SOFTWARE\McAfee\AVEngine\PUPDatDate    Common Standard Protection:Prevent modification of McAfee Scan Engine files and settings    Action blocked : Delete

       

      The above was when the update occured.It also relogs whenever Outlook starts up. I'm hoping it's just a glitch in this update?

        • 1. Re: Outlook causing access protection error?

          I'm also seeing the same behavior - it looks like I was still writing my question while you posted yours. I can't see what's changed apart from the routine DAT update - we're now running 5922.

          • 2. Re: Outlook causing access protection error?
            andyross

            I'm seeing this on multiple computers. Maybe it has something to do with that other update involving Buffer Overflow protection in another thread?

            • 3. Re: Outlook causing access protection error?

              It may be related. It wasn't checked into our Current branch last night as it's set to only download DAT's, but it was checked into Evaluation. The clients that are exhibiting the Access Protection errors are picking up their DATs from the Current branch, so havent' picked up the Buffer Overflow DAT.

              I've pushed the Buffer Overflow DAT to the Current branch, but at the moment it doesn't appear to have changed the issue.

              • 4. Re: Outlook causing access protection error?
                andyross

                I updated to today's DAT (5923), and no change. I do notice that in the About box, there is this:

                 

                Buffer Overflow and Access Protection DAT Version:        480

                 

                I don't remember if that was ever listed before. I wonder if they changed some rules that are causing the errors?

                • 5. Re: Outlook causing access protection error?

                  We got this too after the 5922 update, the update to 5923 hasn't cured the error. Have logged a call with McAfee support will post their reply when I get an answer. Interestingly though this hasn't affected a few test PC's with virus scan 8.7 installed, or could just have been lucky that the PC wasn't switched on and missed the 5922 update.

                   

                  Will post the fix, if I get one from support.

                  • 6. Re: Outlook causing access protection error?
                    jmcleish

                    I've had reports of the same thing on 8.5 (p8)  but not 8.7 (p3)

                     

                    I too think its got something to do with the BO dat upgrade.


                    17/03/2010    17:24:05    NT AUTHORITY\SYSTEM    Product(s) running the latest DATs.
                    17/03/2010    17:24:05    NT AUTHORITY\SYSTEM    Verifying BocDet_VSE.McS.
                    17/03/2010    17:24:05    NT AUTHORITY\SYSTEM    Downloading BocDet_VSE.McS.
                    17/03/2010    17:24:05    NT AUTHORITY\SYSTEM    Searching available updates for BOC DAT.
                    17/03/2010    17:24:05    NT AUTHORITY\SYSTEM    Downloading PkgCatalog.z.
                    17/03/2010    17:24:05    NT AUTHORITY\SYSTEM    Verifying PkgCatalog.z.
                    17/03/2010    17:24:05    NT AUTHORITY\SYSTEM    Extracting PkgCatalog.z.
                    17/03/2010    17:24:05    NT AUTHORITY\SYSTEM    Loading update configuration from: PkgCatalog.xml
                    17/03/2010    17:24:06    NT AUTHORITY\SYSTEM    Starting BOC DAT update.
                    17/03/2010    17:24:06    NT AUTHORITY\SYSTEM    Downloading vscan.bof.
                    17/03/2010    17:24:06    NT AUTHORITY\SYSTEM    Update succeeded to version 480.

                    • 7. Re: Outlook causing access protection error?

                      I don't know if it's relevent, but I've only found these alerts from machines where the users are local administrators. I'll assume that for non-administrators, Windows security steps in to prevent access to the keys rather than VirusScan's Access Protection.

                      • 8. Re: Outlook causing access protection error?
                        andyross

                        At the moment, it's more of a nuisance. I wonder if it's safe to add Outlook to the exceptions?

                        • 9. Re: Outlook causing access protection error?

                          I, too, have noticed this problem, starting the morning of 3/17.

                           

                          We have McAfee VS Enterprise 8.5.0i, scan engine 5400.1158, current DAT version 5924.0000 (although it started on 3/17 with an earlier DAT).

                           

                          Also on machines of users with admin privilege.

                           

                          See also another thread on same topic: http://community.mcafee.com/message/120087

                           

                           

                          Message was edited by: lowlyenduser to add link to another thread on 3/19/10 8:36:09 AM CDT
                          1 2 3 Previous Next