REVIEW DETECTED CHANGES

[AuntieKate]

What is this about? It has only started appearing since WD and almost every time I power on I get asked to review and apply the change. However, none of the details (eg version or date) has changed. I allow and apply it every time since it seems to be for McAfee VirusScan.

Summary:
Services and Drivers change occurred.
This agent monitors services and drivers acting as part of Windows, often running with high security privileges. It ensures that no services are being interfered with or added without proper consent.
Path:
C:\WINDOWS\system32\drivers\EntDrv51.sys
Detected changes:
driver:
EntDrv51
file:
C:\WINDOWS\system32\drivers\EntDrv51.sys
Advice:
Allow this detected item only if you trust the program or the software publisher.
Publisher:
Network Associates, Inc
Digitally Signed By:
NOT SIGNED
Product name:
Virus Scan Enterprise, Entercept
Description:
EntDrv
Original name:
EntDrv.sys
Creation date:
18/08/2004 8:00 AM
Size:
8320 bytes
Version:
8.0.0.240
Type:
file type unknown
Checkpoint:
Drivers
Category:
Not Yet Classified

What can I do to stop this recurring?
Auntie Kate

 

[plun]

Hi Auntie Kate

What can I do to stop this recurring?

WD seems to suffers a really "bad memory" about allowed items.

I have the Acrobat Launcher that needs to be allowed after every
reboot.

Just to wait for MS to fix the software logic for "Allowed items" or
to uncheck notifys.

"Best practise" with this bug is up to you to deside, default MS design
is unchecked notifys, but that is not something I personally prefer.

I want to see when application "wwhhdufgte.exe" tries to change
something.

MS design priciples for WD:
http://www.microsoft.com/athome/security/spyware/software/msft/antispywarecycle.mspx

So "unknown software" is within the center and the challenge key for
this

regards
plun

 

[Bill Sanderson]

I think we'll need to wait for Microsoft and McAfee to work this out. Are
all the McAfee details unchanged, from one alert to the next? You can see
these alerts in the System Event log, I believe.

--

What is this about? It has only started appearing since WD and almost
every time I power on I get asked to review and apply the change. However,
none of the details (eg version or date) has changed. I allow and apply it
every time since it seems to be for McAfee VirusScan.

Summary:
Services and Drivers change occurred.
This agent monitors services and drivers acting as part of Windows, often
running with high security privileges. It ensures that no services are being
interfered with or added without proper consent.
Path:
C:\WINDOWS\system32\drivers\EntDrv51.sys
Detected changes:
driver:
EntDrv51
file:
C:\WINDOWS\system32\drivers\EntDrv51.sys
Advice:
Allow this detected item only if you trust the program or the software
publisher.
Publisher:
Network Associates, Inc
Digitally Signed By:
NOT SIGNED
Product name:
Virus Scan Enterprise, Entercept
Description:
EntDrv
Original name:
EntDrv.sys
Creation date:
18/08/2004 8:00 AM
Size:
8320 bytes
Version:
8.0.0.240
Type:
file type unknown
Checkpoint:
Drivers
Category:
Not Yet Classified

What can I do to stop this recurring?
Auntie Kate

 

[AuntieKate]

It always shows the same settings. Funny thing is it doesn't always show
up. I did a manual update of McAfee yesterday and didn't get this message
this morning, but it has since returned.

If you go into Tools, Software Explorer, it shows the driver as being
Allowed under the Network Associates Inc heading. This shows even before
I press Allowed, so it must be a Microsoft - McAfee thing, as you say, Bill.
The driver has been around since 18/08/2004 so it must be some oversight of
some sort.
Auntie Kate

 

[Bill Sanderson]

Antivirus vendors take strange and wonderful precautions to assure the
integrity of their mechanisms. I don't have any clients running McAfee, so
I've never seen this first hand--all I can advise is staying tuned.

--