1 2 Previous Next 12 Replies Latest reply on Jan 10, 2012 4:48 AM by Sailendra Pamidi

    Both VirusScan 8.7 and 8.8 displayed in System Details after upgrade to VSE 8.8

    ralfrino

      Hi,

       

      We have a customer who experiences strange behaviour of what is displayed in the System Details of any system that is upgraded from 8.5 to 8.8 and 8.7 to 8.8. On those machines, both versions are displayed to be installed:

       

      double VSE.png

       

      When you open the VirusScan console locally, only version 8.8 is displayed.

       

      Since the issue we have updated ePO 4.5 to patch 4 and Agent 4.5 to patch 2. No difference afterwards.

       

      Any idea what could cause this behaviour?

      Thanks

        • 1. Re: Both VirusScan 8.7 and 8.8 displayed in System Details after upgrade to VSE 8.8
          hem

          Do you see two versions on the client machine also?

           

          Please check McAfee agent tray icon and Add/Remove Program.

           

          If listed only one version on the client machine then please send wakeup call from the ePO server (check the box 'force complete and policy and task update') and that should update the machine's property.

          1 of 1 people found this helpful
          • 2. Re: Both VirusScan 8.7 and 8.8 displayed in System Details after upgrade to VSE 8.8
            tfk23

            I saw this on 40 machines we pushed out.    I found if you push the agaent again to the system with  "force installation over existing version" checked  it correctly displays   This also works on the machines by using  FramePkg.exe /install=agent /forceinstall /silent.  

            • 3. Re: Both VirusScan 8.7 and 8.8 displayed in System Details after upgrade to VSE 8.8
              ralfrino

              Thank you both for your suggestions.

               

              On the local machine, only one version is displayed in the console, Agent log, registry, add/remove programs etc.

              We also tried the forceinstall option locally and in the install task, but still the same.

              • 4. Re: Both VirusScan 8.7 and 8.8 displayed in System Details after upgrade to VSE 8.8
                hem

                Just wanted to check if you have sent wakeup call from the ePO server by checking the box ''force complete and policy and task update''.

                 

                If you did then was wakeup succesful. Please verify on the client machine in Agent monitor windows.

                 

                If yes then refresh the page and I am sure that other entry will be removed.

                 

                If not then please delete the machine from ePO console (If not using EEPC), don't select to 'Remove agent', initiate ASCI from the client machine (CmdAgent.exe /s) and click on different tabs like 1-collect and send props etc).

                 

                Machine entry will be created in the ePO server and it should show only one version.

                • 5. Re: Both VirusScan 8.7 and 8.8 displayed in System Details after upgrade to VSE 8.8
                  ralfrino

                  thanks hem,

                   

                  Yes we did a force complete update.

                  I noticed that the VSE 8.7 extension was out-of-date, upgraded it to v8.7.0.195 and started some more wake-up calls, with the force option ticked.

                  No real progress, I even notice that on some computers policies are enforced for both versions of VSE. This would tell me that the problems is rather local. Not sure at this point though.

                   

                  screen1.png

                   

                  And it gets more surreal. When looking in the list of installed software, we see VSE 8.8 installed and Antispyware plugin v8.7. (This is not the machine that I checked in my previous message), when clincking Uninstall while AntiSpyware Enterprise is selected, it (hold on to your seat) starts an On Demand scan task with the name "UninstallMAS" and it claims to have scanned 1 file but found nothing. Pure comedy.

                  Then Windows 7 asks me if it should try to uninstall the software with recommended settings. Clicking yes, exactly the same happens: On Demand Scan task, 1 item scanned, nothing found.

                   

                  comedy.png

                   

                  We're going to find the MSI codes for the VSE and Antispy products and try to remove them manually with msiexec.

                  I'll keep you posted tomorrow but any suggestions in meantime are very welcome.

                   

                  Thanks.

                  • 6. Re: Both VirusScan 8.7 and 8.8 displayed in System Details after upgrade to VSE 8.8
                    JoeBidgood

                    This would imply that the client machine thinks both products are installed...  check the HKLM\Software\Network Associates\ePolicy Orchestrator\Application Plugins registry key: do you kave subkeys for VIRUSCAN8700 and VIRUSCAN8800 ?

                     

                     

                    HTH -

                     

                    Joe

                    • 7. Re: Both VirusScan 8.7 and 8.8 displayed in System Details after upgrade to VSE 8.8
                      ralfrino

                      That is correct, Joe, thanks for pointing that out.

                       

                      Windows Registry Editor Version 5.00

                       

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins]

                       

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\CMNUPD__3000] -contents purged for clarity-

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\EPOAGENT3000] -contents purged for clarity-

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\EPOAGENT3000META] -contents purged for clarity-

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\PCR_____1000] -contents purged for clarity-

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\SYSPROPS1000] -contents purged for clarity-

                       

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8700]

                      "Product Name"="McAfee VirusScan Enterprise Workstation"

                      "Plugin Path"="C:\\Program Files\\McAfee\\VirusScan Enterprise\\VsPlugin.dll"

                      "McTrayAboutBoxDisplay"=dword:00000000

                      "Uninstall Command"="msiexec /x {147BCE03-C0F1-4C9F-8157-6A89B6D2D973} REMOVE=ALL REBOOT=R /q"

                      "Installs CMA"=dword:00000001

                      "HotFixVersions"="1"

                      "CLSID"="{9BE8D8A1-2DB5-4A29-A95F-50C8B27820DA}"

                      "Install Path"="C:\\Program Files\\McAfee\\VirusScan Enterprise\\"

                      "Software ID"="VIRUSCAN8700"

                      "Version"="8.7.0.570"

                      "Language"="0000"

                      "Plugin Flag"=dword:00000000

                      "DatDate"="04182011"

                      "DatInstallDate"="20110419094423"

                      "DATVersion"="6320.0000"

                       

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800]

                      "Product Name"="McAfee VirusScan Enterprise Workstation"

                      "Plugin Flag"=dword:00000000

                      "Version"="8.8.0.777"

                      "McTrayAboutBoxDisplay"=dword:00000000

                      "Uninstall Command"="msiexec /x {CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF} REMOVE=ALL REBOOT=R /q"

                      "Installs CMA"=dword:00000001

                      "Plugin Path"="C:\\Program Files\\McAfee\\VirusScan Enterprise\\VsPlugin.dll"

                      "Language"="0000"

                      "Install Path"="C:\\Program Files\\McAfee\\VirusScan Enterprise\\"

                      "Software ID"="VIRUSCAN8800"

                      "CLSID"="{9BE8D8A1-2DB5-4A29-A95F-50C8B27820DA}"

                      "DatDate"="04182011"

                      "DatInstallDate"="20110419094423"

                      "DATVersion"="6320.0000"

                       

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VSEMAS870000]

                      "Plugin Path"="C:\\Program Files\\McAfee\\VirusScan Enterprise\\VsPlugin.dll"

                      "Software ID"="VSEMAS870000"

                      "Plugin Flag"=dword:00000006

                      "Uninstall Command"="\"C:\\Program Files\\McAfee\\VirusScan Enterprise\\scan32.exe\" /UninstallMAS"

                      "Product Name"="McAfee AntiSpyware Enterprise Module"

                      "Language"="0000"

                      "Version"="8.7.0.129"

                       

                       

                      Reading the uninstall command for VSEMAS870000 I also understand why uninstalling the AntiSpyware plugin starts an ODS. It contains scan32.exe, which probably makes sense for a VSE 8.7 installation, but not for VSE 8.8, which has no separate Antispyware component.

                      • 8. Re: Both VirusScan 8.7 and 8.8 displayed in System Details after upgrade to VSE 8.8
                        JoeBidgood

                        Hm. Looks like, for whatever reason, the reg keys for VSE 8.7 and its AS module haven't been removed - I'm afraid I don't know why.

                        The good news is it should be perfectly safe to remove them. (you might want to export them for safety, although it's unlikely you'll need them again.) Delete the VIRUSCAN8700 and VSEMAS8700 keys - you might need to disable VSE's access protection first if it is enabled  - and then restart the framework service. The agent should then correct the entries in the ePO server.

                         

                        HTH -

                         

                        Joe

                        • 9. Re: Both VirusScan 8.7 and 8.8 displayed in System Details after upgrade to VSE 8.8
                          ralfrino

                          Some further analysis showed that the situation was even more skewed than initially reported. We found Agent installations in "McAfee" and "Network Associates" folders of the same computer, same thing with VirusScan Enterprise 8.7 and 8.8.

                          The customer managed to repair the systems by running the frminst.exe /remove=agent command, which for some reason "unlocked" the items in Add/Remove programs so the AntiSpyware module could be uninstalled, both VSE installations became visible in the list so uninstall of VSE 8.7 could also be executed. This required some reboots but the system now looks to be repaired or sanitized or what you would call it.

                           

                          Thanks for your input in this!

                          1 2 Previous Next