1 2 Previous Next 10 Replies Latest reply on Nov 12, 2010 8:30 AM by daheri

    On-Access Scan Messages keep popping up when browsing

      Hi,

       

      Yesterday my McAfee started behaving strange. An On-access scan message appeared warning me about a "Potentially unwanted program" in a cookie. Status was "deleted".

      So I thought it should be ok, but oh no. After this it only got worse. Almost every time I browse to a new page, a new message appeares telling me about yet another cookie deleted. This happens even if I just try to navigate to www.google.com

       

      Ok, so I thought I might have a virus and then I stopped browsing and did a full scan of my system. Absolutly nothing was detected. So then I started browsing again, but the same messages keeps appearing. So whats up with this behaviour? It is extremly annoying (since I have to click the on-access scan message away every half minute), and if I have I virus it could be dangerous.

       

      Anyone got any idea what I should do??

       

      Thanks in advance!

       

      McAfee details:

        
      McAfee Agent 
      Version number: 4.5.0.1270
      Managed 
      Last security update check: 12.11.2010 08:58:44
      Last agent-to-server communication: 12.11.2010 08:53:05
      Agent to Server Communication Interval (every): 1 hours 30 minutes 0 seconds
      Policy Enforcement Interval (every): 30 minutes
      Agent ID: {8E77DD8B-B078-4634-967D-6AE6ACC3964B}
      ePO Server/Agent Handler 
        
        
      Host Intrusion Prevention 7.0.0 
      Version number: 7.0.0.1159
      Language: English (United States)
        
        
      VirusScan Enterprise 
      Version number: 8.7i (8.7.0.570)
      Build date: 25.08.2010
        
      Anti-virus License Type: licensed
        
      Scan engine version (32-bit): 5400.1158
        
      DAT version: 6156.0000
      DAT Created on: 2010/11/03
        
      Number of Signatures in extra.dat: 0
      Name of threats that extra.dat can detect: None 
      Buffer Overflow and Access Protection DAT version: 499
      Installed Patches: 4

        • 1. Re: On-Access Scan Messages keep popping up when browsing
          Peacekeeper

          While waiting for someone more knowledgable 1 thing that strikes me is your Dat is 8 days old...

           

          Can you also post a pic of the message...

          • 2. Re: On-Access Scan Messages keep popping up when browsing

            Thanks for your reply. Here is a screenshot of the error-messages popping up. Do you think that the DAT file could be the reason for this?

            error1.jpgerror2.jpg

            • 3. Re: On-Access Scan Messages keep popping up when browsing
              tonyb99

              You have cookie detection enabled and also set to show these pickups to the user. The system is acting as it should considering your settings.

               

              Are your poicies managed by an epo server ( in which case you need to have changes made to the VSE policies associated with your pc) or do you have the ability to manage the policies yourself?

               

              to get rid of being notified about cookies

               

              1)     go to vse console and right click on on access scanner and choose properties

                      (or in epo go the the vse 8.7 policies associated with the pc)

              2)     go to general settings, messages tab and untick the notify about cookie dections (pretty much same thing in epo)

               

              to stop cleaning/scanning cookies at all

               

              go to general settings, general tab remove tick from scan cookies

              • 4. Re: On-Access Scan Messages keep popping up when browsing

                Thanks for your reply.

                 

                I cannot find any checkbox "notify about cookie dections"

                On my general settings -> messages tab, I can find a checkbox "Show the messages dialog box when a treat is detected and display the specified text in the message"

                Other than that setting, which I assume disables all notification of treats?, the only options available are "Actions available to user".

                I cannot find the option to disable cookie scan either. I looked in the general tab under general settings, but the only options under scan are:

                Boot sectors

                Floppy during shutdown

                processes on enable

                 

                I'm sure if I disable the option to "show messages dialogbox when treat detected...", that the popup messages will dissapear, but is this safe? Are you sure my errors are not caused by an actual treat, and if I encounter a more serious treat later on, how will I know?

                • 5. Re: On-Access Scan Messages keep popping up when browsing
                  tonyb99

                  (duh@me) You dont have the anti spyware module installed which would allow you the extra functionality to pick out cookies as a specific option (I forgot to check you original post list of installed apps) you are picking them up as PUPS with the unwanted programs policy of VSE.

                  You can go into the policy for this and turn off the "other potentially unwanted programs" tick box but be aware though this may impact you're ability to find some additional PUPs not already classified into the sections above it.

                   

                  Of course you are already missing most of the PUPS anyway as you don't have the aspw module I would say you really need this to feel covered, but its an additional cost to basic vse. I notice you have hips though so if you are buying an endpoint package rather than seperates you may find you have the aspw module already included, I know it is on ours.

                  1 of 1 people found this helpful
                  • 6. Re: On-Access Scan Messages keep popping up when browsing

                    Ok, I found the option to turn off "other potentially unwanted programs".

                     

                    But one thing is still bugging me. How come I get these warnings in the first place? I have been running McAfee for a long time, but the warnings just startet popping up yesterday. How come I didnt get any warnings before, and now there are tons of warnings? Why are suddenly almost every cookie a "potentially unwanted program"?

                    • 7. Re: On-Access Scan Messages keep popping up when browsing
                      tonyb99

                      when did you install patch 4? it may have overwritten your previous settings

                      • 8. Re: On-Access Scan Messages keep popping up when browsing

                        Im not really sure. Being the typical end-user i am, I just install whatever upgrades that comes along and get on with my business. Honestly I have no idea, im sure I installed some upgrade for something this week, but I cant tell if it was windows update, mcafee, adobe or what not.

                         

                        I cant help to feel that just turning off the "potential unwanted program"-feature is a bit to easy. I mean, if McAfee has programmed this thing to popup and warn me, I'm sure it must be something that is worth warning about. Right?

                         

                        And it could ofcourse be, as you said, that the settings have been altered with the update. But if this was the case, there must be thousands, no millions, of users out there with the same issue as me. Cause 99% of my browsing is well within what you would call "safe" sites. And I still get new warnings..

                        • 9. Re: On-Access Scan Messages keep popping up when browsing
                          tonyb99

                          the thing is it flags all tracking cookies as pups... but most people dont really care about tracking cookies

                          as I said prev you have hips installed so i would assume that your AV is managed by someone somewhere is this not the case?

                          if you can get it under your current licence you would be well served to install the aspw module and this will allow you to turn off cookie notifications while keeping additonal pup detections, it also allows you to access thousands of additional pup dections that you cant currently and scan the registry for spyware.

                          1 2 Previous Next