McAfee Virus Scan ver 6 vs ver 9 Virus detecting

[slc]

Help:

I'm running McAfee Virus Scan version 6 on
computer number 1, when I visit a web site
it detects a virus in the download file and
ask me to delete its.
When I visit the same web site on computer
number 2 running McAfee Virus Scan version
9 it does not detect the virus and ask me to
delete it. Both version of McAfee have the
latest Dat file installed.
Why does version 6 of McAfee Virus Scan
detect the Virus and version 9 does not and
how do I fix it so that version 9 will detect the
Virus and delete it?

Thanks
Kevin

 

[David H. Lipman]

The question then becomes what is the ENGINE and DAT versions on both the VirusScan v6 and
VirusScan v9 platforms.

Dave




| Help:
|
| I'm running McAfee Virus Scan version 6 on
| computer number 1, when I visit a web site
| it detects a virus in the download file and
| ask me to delete its.
| When I visit the same web site on computer
| number 2 running McAfee Virus Scan version
| 9 it does not detect the virus and ask me to
| delete it. Both version of McAfee have the
| latest Dat file installed.
| Why does version 6 of McAfee Virus Scan
| detect the Virus and version 9 does not and
| how do I fix it so that version 9 will detect the
| Virus and delete it?
|
| Thanks
| Kevin
|

 

[slc]

V6 ENGINE is 4.3.20 and the DAT file is 4.0.4411.
V9 ENGINE is 4.3.20 and the DAT file is 4.0.4411.

Kevin

 

[slc]

V6 ENGINE is 4.3.20 and the DAT file is 4.0.4411.
V9 ENGINE is 4.3.20 and the DAT file is 4.0.4411.

Kevin

 

[David H. Lipman]

I would they guess that the KERNEL (VirusScan v6.x) is causing the generation of a False
Positive.

The way to really test this is using the McAfee Command Line Scanner v4320 and v4400 and not
the GUI scanner.

Dave



| V6 ENGINE is 4.3.20 and the DAT file is 4.0.4411.
| V9 ENGINE is 4.3.20 and the DAT file is 4.0.4411.
|
| Kevin
|

 

[slc]

I'm not using the GUI to scan. the VShield is deteching the virus when
I access the web site.
I looked up the virus name at McAfee and it is a Trojan called
"Exploit-MhtRedir.gen"
the file that is download is "Index2[1].htm"
so it is a virus and ver 6 is caching it like it should but ver 9 is
not caching it.
Any other idies on how to fix ver 9?
I'm also going to enter this same question on the McAfee forum web
site.

 

[David H. Lipman]

So it is NOT a virus at all ! Exploit codes are not viruses.
In fact, it is not an infector, it is HTML attempt at a vulnerability exploit and the McAfee
Command Line Scanner will only flag it if the HTML file is on the hard disk.

So, what's the version of browser being used on the VirusScan v9 platform and on the
VirusScan v6 platform ?

What is the URL ?

Dave




| I'm not using the GUI to scan. the VShield is deteching the virus when
| I access the web site.
| I looked up the virus name at McAfee and it is a Trojan called
| "Exploit-MhtRedir.gen"
| the file that is download is "Index2[1].htm"
| so it is a virus and ver 6 is caching it like it should but ver 9 is
| not caching it.
| Any other idies on how to fix ver 9?
| I'm also going to enter this same question on the McAfee forum web
| site.
|

 

[slc]

The browser being used on both computers/platform is internet explorer
version 6.0.2800.1106.xpsp2.........

As for the URL, I was searching using Google one day a ran across the
site with the virus and then did the same search on the other computer.
I can not find the URL in my history or remember what I was searching
for. Sorry. It will happen again one of these days.