McAfee disabled by Defender

[Guest]

Hello... First time poster, so I hope I am asking this in the correct place.
Has anyone else had Windows Defender disable and turn off your McAfee
anti-virus? I have had this happen three times now.....it seems as though my
McAfee gets turned off with every scan of Defender. Anyone else have this?
Many thanks for any info and replies.
Tommy

 

[Bill Sanderson]

I haven't seen this, but I have seen complaints that mcafee executables need
to be approved at every boot.

I'd be interested in seeing the logs of what is detected/removed in these
scans.

If you do start, run, eventvwr.msc, then go to View, Filter, and scroll down
the "source" control to reach Windefend, that will give you a view of just
Windows Defender-related events.

Look for events with yellow triangles.

open these for the most recent scan, and use the button provided to paste
the content to the clipboard. You can then paste it into a reply here. I'd
like to try to get a look at what is happening.

 

[Steve Wechsler [MVP]]

Slight alteration, Tommy ...

" If you do start, run, eventvwr.msc, **click OK**, then click on
**System**, then View, then Filter, and scroll down the " event source"
control to reach Windefend, that will give you a view of just Windows
Defender-related events.

Look for events with yellow triangles.

open these for the most recent scan, and use the button provided to
paste the content to the clipboard. You can then paste it into a reply
here. I'd like to try to get a look at what is happening. "

Steve Wechsler (akaMowGreen)
MS-MVP 2003-2006
===============
*-343-* FDNY
Never Forgotten
===============

 

[Bill Sanderson]

Whoops--That's correct.

--

Slight alteration, Tommy ...

" If you do start, run, eventvwr.msc, **click OK**, then click on
**System**, then View, then Filter, and scroll down the " event source"
control to reach Windefend, that will give you a view of just Windows
Defender-related events.

Look for events with yellow triangles.

open these for the most recent scan, and use the button provided to paste
the content to the clipboard. You can then paste it into a reply here.
I'd like to try to get a look at what is happening. "

Steve Wechsler (akaMowGreen)
MS-MVP 2003-2006
===============
*-343-* FDNY
Never Forgotten
===============

 

[Guest]

Oh boy.... I have no idea if this reply is going to show up... I am new
here, and had difficulty trying to locate the "reply" button... I hope this
displays in the proper place.. I just looked through my event viewer, and
the yellow error numbers are 3004. These are listed to the right
hand side of "system" in the event viewer. I hope this is the info you asked
for... Just for info... I ran Defender three more times after I posted the
other day, and I did not encounter any shutdown of my McAfee. BUT.... I ran
Ewido scanner, and it shut down McAfee... this is very strange to me...
Perhaps this was a McAfee bug? My Dell E-510 is brand spankin' new, and free
of all viri and malwares. My computer is all "stealthed" with Zone Alarm,
and my comp passes the Shield's Up test site.

 

[Guest]

I have exactly the same problem! I would be on line and notice Mcaffee Virus
checker had been disabled. It coincided with Defender doing its scheduled
scan. I then experrimented offline manually activating Defender and sure
enough it disables Mcafee Virus checker every time. The other components of
Mcafee Security Suite 2006 v8 ie Firewall, Spamkiller are unaffected. I
bought my Mcafee from Ebay. It works great, uploading new Virus definitions
and I have no reason to suspect the Mcafee software is corrupt but who knows.
Where did yo get your Mcafee Software? If its not theMcafee software then
I'd appreciate some simple help on this one.

 

[Bill Sanderson]

I think that when Ewido removes stuff--it creates a restore point or some
other mechanism that allows you to restore what it has removed--I'd
recommend using that mechanism--or at least learning more about how it
works.

With regard to Windows Defender--we need a little more, I'm afraid.

When you get to where you can see the yellow triangle entries--I need you to
actually open then by double clicking on each one in the right pane--that
will get you to the details of each entry, and the button that will allow
you to cut and paste those details back to a message here.

If there are a lot of them--just pick one or two--I'd like to get a look at
what is being removed.

 

[Bill Sanderson]

Can you also post details of what is being removed--using the event
viewer--read the other messages here to see how to do that?

I would also suggest this change to the Windows Defender general settings:

In Windows Defender, go to Tools, General Settings. Under Automatic
scanning, uncheck "Apply actions on detected items after scanning.

This will require you to check Windows Defender (it will alert you in the
Notification area) to take action on items found during a scan--and you can
read the details carefully and choose whether or not to remove items.

--

 

[Guest]

I use Defender and Ewido, and I have not noticed that problem with McAfee. Is
"virus checker" the same thing as "activer shield" or is that the email
component? I am using 2005 VirusScan 10.0.27 and 2005 Personal Firewall Plus
7.1.113. I bought my CDs at Walmart. LOL! In any case, when installed, they
update on line.I do know that if you do a system restore, VivusScan can
become corrupted. You would think that a simple update could fix that, but it
sometimes requires a fresh instnall. PITA!!! I do not have Defender set to
do anything automatically except for a quick scan daily and RTP. No automatic
cleaning.

 

[Guest]

I suspect that you have a problem with VirusScan rather than a conflict with
Windows Defender. There are many reasons McAfee can become disabled. One is
not rebooting after an update. I recommend registering at the following
McAfee forum and posting your issue:
McAfeehelp.com :: FORUMS index
http://forums.mcafeehelp.com/index.php?c=7

 

[Steve Dodson [MSFT]]

I am unsure what is going on here. Is this is an issue with Windows
Defender? If it is, can you tell me more details?

--
-steve

Steve Dodson [MSFT]
Windows Defender Beta Lead
MCSE, CISSP
http://blogs.technet.com/stevedod
--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.

 

[Guest]

Definitely issues going on between McAfee Virusscan and Defender. Defender
hasn't shut down my McAfee yet but it has disabled/interupted daily virus
scans. The defender scans and Mcafee scans are set to run hours apart from
each other so no interference there. Every day I get multiple logs in
Defender asking if I want to allow c:\program
files\mcafee.com\vso\mcmnhdlr.exe. Every day I check allow but it never
shows up in my "allowed list" in Defender. I have a history log full of them
exactly the same string above. I just went back to general user hoping
Defender will quit asking me to allow when it really isn't allowing it.
Defender doesn't like Task Manager running a scheduled virus scan. I think
the beta/spynet folks need to "classify" this or explain why this Mcafee
scheduled task is dangerous. I've used MSAS and VirusScan flawlessy
"together' for some time and I want to keep doing the same w/ Defender. I
don't want to turn daily virus scans off just like I don't want to turn
defender scans off.

I am unsure what is going on here. Is this is an issue with Windows
Defender? If it is, can you tell me more details?

--
-steve

Steve Dodson [MSFT]
Windows Defender Beta Lead
MCSE, CISSP
http://blogs.technet.com/stevedod
--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.

Can you also post details of what is being removed--using the event
viewer--read the other messages here to see how to do that?

I would also suggest this change to the Windows Defender general settings:

In Windows Defender, go to Tools, General Settings. Under Automatic
scanning, uncheck "Apply actions on detected items after scanning.

This will require you to check Windows Defender (it will alert you in the
Notification area) to take action on items found during a scan--and you
can read the details carefully and choose whether or not to remove items.