McAfee AntiVirus vs HijackThis

[Chuck]

I was helping a friend (remotely) setup her new computer, which came with McAfee
Security Center (McAfee VirusScan Build 9.0.10 Engine 4.3.20 DAT 4.0.4388). I
added HijackThis, as I do for all computers that I help setup.

I downloaded HJT from my computer, using UltraVNC. As soon as the download
finished, Mcafee popped up and announced that it had deleted HJT, which
contained a virus.

I cussed a bit, scanned my system (clean), and submitted the copy of HJT to
Jotti <http://virusscan.jotti.org/>, and VirusTotal <http://www.virustotal.com>.
No hits from either site - the file was clean.

So I started the browser on the remote computer, and downloaded HJT from
<<http://www.tomcoyote.com/hjt/>. As soon as the download finished, McAfee
sprung into action again, and deleted THAT copy too.

I cussed again, disabled McAfee, and loaded and ran HJT. Then we rebooted and
re enabled McAfee. I submitted that copy of HJT to the two websites, again
negative results.

Anybody else have this experience? I couldn't find any exclusion settings,
either for file name, or folder, anywhere in the MAV setup.

--
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
My email is AT DOT
actual address pchuck sonic net.

[Mich]

"Chuck" <none@example.net> wrote in message
news:27sj51tamjjskoitdsjck4n4tm4ia4foih@4ax.com...
> I was helping a friend (remotely) setup her new computer, which came with
McAfee
> Security Center (McAfee VirusScan Build 9.0.10 Engine 4.3.20 DAT
4.0.4388). I
> added HijackThis, as I do for all computers that I help setup.
>
> I downloaded HJT from my computer, using UltraVNC. As soon as the
download
> finished, Mcafee popped up and announced that it had deleted HJT, which
> contained a virus.
>
> I cussed a bit, scanned my system (clean), and submitted the copy of HJT
to
> Jotti <http://virusscan.jotti.org/>, and VirusTotal
<http://www.virustotal.com>.
> No hits from either site - the file was clean.
>
> So I started the browser on the remote computer, and downloaded HJT from
> <<http://www.tomcoyote.com/hjt/>. As soon as the download finished,
McAfee
> sprung into action again, and deleted THAT copy too.
>
> I cussed again, disabled McAfee, and loaded and ran HJT. Then we rebooted
and
> re enabled McAfee. I submitted that copy of HJT to the two websites,
again
> negative results.
>
> Anybody else have this experience? I couldn't find any exclusion
settings,
> either for file name, or folder, anywhere in the MAV setup.
>
> --
> Cheers,
> Chuck
> Paranoia comes from experience - and is not necessarily a bad thing.
> My email is AT DOT
> actual address pchuck sonic net.




Yea happened to me at a customers home, the version I used was the new
version of HJT. My workaround was to just use the older version of HJT and
I had no problems.

Mich...

[Bob]

Chuck wrote:
> I was helping a friend (remotely) setup her new computer, which came
> with McAfee Security Center (McAfee VirusScan Build 9.0.10 Engine
> 4.3.20 DAT 4.0.4388). I added HijackThis, as I do for all computers
> that I help setup.
>

Chuck,

Update McAfee - both the engine and DAT files are old. I'm running
VirusScan 7, but the engine is at 4.4.00, and my DAT files are 4.0.4465,
dated 4/8/2005. You are probably seeing a false positive that was fixed in
later DAT files; I've recently downloaded HijackThis with no problems or
comments from McAfee.

Bob.

[David H. Lipman]

From: "Bob" <bobk4000JUNK@JUNKyahooJUNK.JUNKcom>


| Chuck,
|
| Update McAfee - both the engine and DAT files are old. I'm running
| VirusScan 7, but the engine is at 4.4.00, and my DAT files are 4.0.4465,
| dated 4/8/2005. You are probably seeing a false positive that was fixed in
| later DAT files; I've recently downloaded HijackThis with no problems or
| comments from McAfee.
|
| Bob.
|


That's correct. Both the ENGINE and DAT are old !

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[timberlandko]

"Chuck" <none@example.net> wrote in message
news:27sj51tamjjskoitdsjck4n4tm4ia4foih@4ax.com...
>I was helping a friend (remotely) setup her new computer, which came with
>McAfee
> Security Center (McAfee VirusScan Build 9.0.10 Engine 4.3.20 DAT
> 4.0.4388). I
> added HijackThis, as I do for all computers that I help setup.
>
> I downloaded HJT from my computer, using UltraVNC. As soon as the
> download
> finished, Mcafee popped up and announced that it had deleted HJT, which
> contained a virus.
>
> I cussed a bit, scanned my system (clean), and submitted the copy of HJT
> to
> Jotti <http://virusscan.jotti.org/>, and VirusTotal
> <http://www.virustotal.com>.
> No hits from either site - the file was clean.
>
> So I started the browser on the remote computer, and downloaded HJT from
> <<http://www.tomcoyote.com/hjt/>. As soon as the download finished,
> McAfee
> sprung into action again, and deleted THAT copy too.
>
> I cussed again, disabled McAfee, and loaded and ran HJT. Then we rebooted
> and
> re enabled McAfee. I submitted that copy of HJT to the two websites,
> again
> negative results.
>
> Anybody else have this experience? I couldn't find any exclusion
> settings,
> either for file name, or folder, anywhere in the MAV setup.
>
> --
> Cheers,
> Chuck
> Paranoia comes from experience - and is not necessarily a bad thing.
> My email is AT DOT
> actual address pchuck sonic net.

Just a thought here - I've found it useful to disable resident
security/privacy software on a client's machine before initiating any of my
own scans, searches, or fixes. I just do that as matter-of-course.

[Jay T. Blocksom]

On 10 Apr 2005 22:56:01 -0500, in <alt.privacy.spyware>, Chuck
<none@example.net> wrote:

> I was helping a friend (remotely) setup her new computer, which came with
> McAfee Security Center (McAfee VirusScan Build 9.0.10 Engine 4.3.20 DAT
> 4.0.4388).
[snip long tale of woe]

You could/should have saved yourself a lot of grief -- both WRT this specific
incident, and in the future -- by simply deleting that crapware from the
system, and replacing it with a *decent* anti-virus package.

--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet02[at]appropriate-tech.net

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this domain is expressly prohibited under
47 USC S227 and State Law. Violators are subject to prosecution.