6 Replies Latest reply on Oct 13, 2010 10:34 AM by jmcleish

    McAfee Not Detecting Viruses (8.5 and 8.7)

      Good Morning,

       

      We've been noticing some left over files that are still causing some issues on our PCs.  It seems to be back from the .lnk issues a few months back, and it's of course causing issues whenever we're connecting USB keys.  The files that are causing the issues are sitting in the User Profile directory and are name %username%.exe.

       

      I of course tried to create my own custom rules to at least stop it from running, but forgot that McAfee doesn't support the %username% variable so I couldn't block it that easily.  Over the past few days, I've submitted samples to McAfee which get detected after a day or so, but strangely enough, when I submit it through Virus Total, it reports back taht almost all other major AV softwares will catch the virus already; just not McAfee.

       

      We're on a mix right now of 8.5 and 8.7 (fully going to 8.7) and also using Artemis.  I even scanned some recent files we found with very high on Artemis and it's still not catching them.

       

      Has anyone had experience like this recently with McAfee? If so, has anyone found an easier way other than submitting several samples to McAfee?

       

      Thanks,

      T

        • 1. Re: McAfee Not Detecting Viruses (8.5 and 8.7)

          Yes, noticed it also.  I have had several drive by Malware not getting picked up as of late (more than normal).  I hope this is not a trend since the whole Intel purchase....  I have reported several samples to avert (comes back as clean) and never get a reply back of the findings in the end other than the automated initial response.  Like you virus total is showing others already picking up on the threats..

          • 2. Re: McAfee Not Detecting Viruses (8.5 and 8.7)
            Regis

            Hi T,

             

            As with any technology that's reliant on the health of the underlying host operating system,   McAfee like other AV's will get into this state, and you have to succumb to the industry best practice of flattening and rebuilding the compromised host to reliably recover the machine.  

             

            Like the other poster, I've seen the trend of the virulence of drive by downloads getting very nasty these days. Even if you have patched perfectly and all your users are running the latest browsers, and have every single plugin fully patched you can still get boxes owned..especially with this vulnerability.  Here, you're dealing with things like the .LNK vulnerablility in stuxnet which was just one of FOUR 0-day exploits in it... and as such it's not at all surprising for variants to be able to take down the AV engine.

             

            Submitting samples is unfortunately the only way to contribute to the hopelessly reactive technology in anti-virus, but alas, it's the best we have in a lot of instances. And this has absolutely nothing to do with the acquisition, I'm sure.   AV was unfortunately kinda broken in this way before Intel bought McAfee. :-\

            • 3. Re: McAfee Not Detecting Viruses (8.5 and 8.7)

              Just to be precise, Intel does not yet "own" McAfee.   Rather, Intel has "entered into a  definitive agreement to acquire McAfee. The agreement can only proceed  pending "McAfee shareholder approval, regulatory clearances and other  customary conditions specified in the agreement".

               

              -- R

              • 4. Re: McAfee Not Detecting Viruses (8.5 and 8.7)
                jmcleish

                Try this:

                Submit your sample to ThreatExpert and find out what it does, then if malicous, submit a sample through the support portal when logged in- with the ThreatExpert link

                 

                Jane

                • 5. Re: McAfee Not Detecting Viruses (8.5 and 8.7)

                  Hi... I've actually been submitting the samples whenever I get them.  It's just that turnaround for what should already be positive detections seems to take longer than expected.  I'll keep submitting for now, but in my opinion, it would be great to have a final and definitive workaround for these types of viruses.

                  • 6. Re: McAfee Not Detecting Viruses (8.5 and 8.7)
                    jmcleish

                    But are you submitting them through the support portal when logged in?

                     

                    Any samples I've submitted, i've had a really quick turnaround- the last two being >1 day.