9 Replies Latest reply on Mar 24, 2011 2:03 PM by joas

    OAS disabled: Root Cause Analysis

      Hello everyone,

       

      I have found multiple occurrences within my organization where OAS has been disabled on random machines. Lately I have been tracking down machines that haven't contact EPO in the past month to find more subjects to investigate and hopefully find a pattern to help us find the root cause. Below is some information about what we are running, plus some patterns that I have found within the machines I have assessed, as well as my questions to the matter.

       

      Running:

      McAfee Agent: 4.5

      VirusScan Enterprise 8.7i

       

       

      Pattern:

      I have found that OAS has been disabled around 8/6/10-8/9/10 dates. These machines all have the similar event log entry of  "The McAfee McShield service depends on the following nonexistent service: mfevtp" which starts coming up around those dates

       

      According to McAfee this event log is ONLY shown when downgrading from 8.7 to 8.5. We never downgraded any systems, so this is not our case.

      https://kc.mcafee.com/corporate/index?page=content&id=KB53973&pmv=print

       

      My Questions

      • Is there a way that I can get a list of McAfee's Updates and when they were pushed onto the community so that I may compare the dates and maybe narrow it down to an update that might have caused this?

       

      I have searched my way around the forum and found some similar threads, but they didn't help. Our EPO enforces OAS being enabled on these machines. All machines that have this problem are virus/spyware free. If you guys have anything that might help with this investigation it would be very much appreciated. Thanks!!

       

      Message was edited by: joas on 3/15/11 8:56:16 AM CDT