1 2 Previous Next 16 Replies Latest reply on Feb 1, 2008 6:04 AM by tonyb99

    VirusScan 8.5 keeps detecting these files. Please Help

      Hi,

      Can you please help? I am browsing the net using Internet Explorer 6.0 and I wish to find out as to why Mcaffee VirusScan 8.5i detects these files constantly whenever I am in a TRUSTED SITES ZONE like Yahoo Mail or even Google page???

      For example, I went to Google page, and I did a refresh on the page 16 times all at once, and the VirusScan detected 16 files in the directory (nowhere else) just in here below...Now why is it constantly detecting these files??? Are these spyware or something?

      :\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\username\Local Settings\Temporary Internet Files\Content.IE5\0P234TUV\login[1].rand=9kq8o5k5hm8do\login[1]

      Are my scanning detections too too restrictive??? I dont understand...

      And these files are NOT quarantined either...so these MUST be safe files..but why is Mcafee detecting these??? And how can I stop it? Is there a setting for this in the scanner?

      Pls help, thanks.
        • 1. RE: VirusScan 8.5 keeps detecting these files. Please Help
          Running the latest Patch #4 for VS 8.5i?

          And just a guess here since I'm not at a VS 8.5i machine, the "Trusted Sites Zone", in the "User Authentication" section, allows files to be run "Automatically with current username and password" and that logon is running from the "Temporary" files location.. If I remember correctly, the "Access Protection/Standard Protection" section logs, but doesn't block, that event as a default setting.. UNCHECKING that selection should allow those types of alerts to stop.

          Hope this helps.

          Grif
          • 2. RE: VirusScan 8.5 keeps detecting these files. Please Help
            Hello,

            Thanks for the reply but Im still confused a bit.

            On ALL the STANDARD sections (e.g. Antispyware, Antivirus) should all these be BLOCKED and NOT to report??

            Also, under the USER DEFINED RULES section, I added that specific directory were these junk files are (in Content.IES) and set it to BLOCK WRITE AND CREATE ACCESS. And still detects these files after I logon to Yahoo Mail or even refreshing the page just in Google website.

            Im running Patch-4, yes.

            And are these files dangerous or there just considered "JUNK" from IE??

            Also, I found this comment doing a Google search that says: Content.ie5 and its subfolders are system folders used by IE for disk caching. Don't try to block their creation.

            So how would I make Mcafee NOT to detect these??? Can you please post some screenshots on how to do this?

            Please explain.
            • 3. RE: VirusScan 8.5 keeps detecting these files. Please Help

               

              On ALL the STANDARD sections (e.g. Antispyware, Antivirus) should all these be BLOCKED and NOT to report??


              NO.

               

              And are these files dangerous or there just considered "JUNK" from IE??


              NO, Temporary Internet Files and Temp files are not "junk".. They're simply used temporarily.

               

              Also, I found this comment doing a Google search that says: Content.ie5 and its subfolders are system folders used by IE for disk caching. Don't try to block their creation.


              As I stated earlier, McAfee is not "blocking" those files. It's simply warning you that the files are running from the "Temporary Internet Files" folder and McAfee is logging the detection..

               

              So how would I make Mcafee NOT to detect these???


              As I stated earlier, I believe you should be able to access the VirusScan Console, double click on the "Access Protection" listing, then click on the "Standard Protection" line.. "If I remember correctly, the "Access Protection/Standard Protection" section logs, but doesn't block, that event as a default setting.. UNCHECKING that selection should allow those types of alerts to stop." Then again, it may be on a different "Protection" line.. It's easy to search those listings and see if any are related to the "Temporary Internet Files" situation.

              Of course, taking those sites out of your "Trusted Sites" zone would probably stop the alerts as well. I find it interesting that you feel confident that "Yahoo Mail" and "Google" won't ever have the possibility of infecting your computer and therefore place them in the "Trusted Sites" zone of Internet Explorer.. Personally, I don't have that same confidence with ANY mail program.. But each to his/her own.

              Hope this helps.

              Grif
              • 4. RE: VirusScan 8.5 keeps detecting these files. Please Help
                Something is not roght here. It keeps on detecting this directory below everytime I visit a webpage and EVERYTHING is UNCKECKED as far as reporting under the Access Proection list and even max protection list aswell. Blocking is also uncheched...

                I do want the scanner to scan these, but not report as being detected.

                1/28/2008 7:07:48 PM Not scanned (The file is encrypted) C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\username\Local Settings\Temporary Internet Files\Content.IE5\W5Y5Y1IT\google[1]\google[1]

                Everywhere I go the scanner detects these. So, I want them to be scanned but I do not want the scanner to detected under the Scanning Statistics.

                So I received 155 detections under the directory above I cannot find a way NOT to detect them.

                I want the scanner to scan them, but not logging these on every webpage I go to....
                • 5. RE: VirusScan 8.5 keeps detecting these files. Please Help
                  OK, Let's start over.. In your posts, you've stated that McAfee is "detecting" the files that are going to the "Temporary Internet Files" folder. This is the first time you've mentioned that you were seeing it in the "Scanning Statistics" which would be related to the "On Access Scanning Statistics". So you aren't get a popup warning? Please tell us EXACTLY how you're seeing the detected files? Are you seeing it by RIGHT clicking on the McAfee shield, then choose "On Access Scanning Statistics" or are you looking at a log of some type. If it's in a log file, why the concern?

                  If all of the messages are listed as "Not scanned (The file is encrypted)", then that type of detection is perfectly normal. Basically, McAfee is telling you the file is encrypted, or in use, and therefore could not be scanned.. It's as simple as that. I am curious why your browser is encrypting all the TIF files but still, it appears to not be the fault of McAfee. Have you installed some type of program that's handling the TIF or cookie files differently? Or have you changed the scanner to something other than default? In the "On Access Scan" properties, under the "General Settings", what happens if you UNCHECK the "Scan cookie files" box? (if it's there)

                  Just curious but... this is an ENTERPRISE product which is primarily for business use and most of the folks here are system admins and such.. Is your machine being used in a corporate situation?

                  Hope this helps.

                  Grif
                  • 6. RE: VirusScan 8.5 keeps detecting these files. Please Help
                    Yep, your right, lets start over.

                    Ok, NO, it does not give me pop-up window, its just detecting in the Scanning Statistics when I double click the virusscan sheild and EVERYTIME I go into google (my Homepage) it automatically detects the files thats generated or created automatically by Windows or Internet Explorer WHICH ARE NORMAL...There part of Windows or Internet Explorer.

                    Also, there are NOT logged in the quarantined area...So I would assume these are in fact false positives.

                    Like I said, I UNCHECKED everytime under REPORT under Access protection lists.

                    Also, I found a tempary fix under Detection, so it excludes the scanning of those files. But, I want the scanner to scan these incase a trojan smeaks its way into those directory but EVERYTIME I go into a webpage....It detects...But does not give me a pop-up window.

                    So...If I open up my Homepage (which is Google), I can click the refresh button 100 times (in Google) and the scanner will detect 100. How can I still let it scan but NOT detect???

                    Im not using any third party encrption software or cookie cleaner. And yes, the detect cookie box is also checked. But I want it to be checked anyways.



                    Is there anyway to add screenshots for nextime???
                    • 7. RE: VirusScan 8.5 keeps detecting these files. Please Help
                      Here are some screenshots:




                      So, in general, how can Mcafee still be able to scan this directory, but not detect?

                      Like I said before, I have a temporary fix to EXCLUDE scanning that directory under ALL PROCESSES.

                      But, I still want the scanner to scan these but detect them everytime.
                      • 8. RE: VirusScan 8.5 keeps detecting these files. Please Help
                        Tried uninstalling the program using the manual instructions in the link below, then reinstalling..? It would have been the first thing I'd try if other issues didn't fix the problem. The default scan shouldn't be doing such a thing and it appears like you've changed things..:

                        Manual Uninstall Of Virus Scan Enterprise 8.5i
                        https://knowledge.mcafee.com/SupportSite/search.do?cmd=displayKC&docType=kc&exte rnalId=612722&sliceId=SAL_Public&dialogID=18768049&stateId=1%200%2018754996

                        Hope this helps.

                        Grif
                        • 9. RE: VirusScan 8.5 keeps detecting these files. Please Help
                          Well, it still detects these....I uninstalled and reinstalled. Then I installed with MAXIMUM protection like I did before...Is this a problem??? Why is it detecting that specific directory???

                          Now, on the Access protection Scan, now please tell me what to unckeck or leave in order for this to not detect that directory like in the screenshots below.

                          This is the directory it always seems to detect...But why???? These are normal files generated by Internet Explorer...

                          C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\username\Local Settings\Temporary Internet Files\Content.IE5\W5Y5Y1IT\login[1].rand=chg08jpkm964q\login[1]

                          Can you please explain in detail on what to uncheck or leave under BLOCK or REPORT?
                          And I wonder if selecting the max protection is the problem or not.
                          1 2 Previous Next