install ens failed

[Dwee]

hi,

i know this topic already have posts but i just have to ask about this,

summary: server os : win server 2008 r2, (unmanaged/not join domain), have many viruses and else (scanned with stinger but after scan it keeps coming back), agent successfully installed using frmpackage from epo,  5.9 , we tried install AV like avast and else still failed too same as when we tried to installed ENS standalone package,

so far we tried to repair the os first than scan with stinger again and hopefully we can install ens after that,

is it save if we try to use mcafee ransomware interceptor too ? (we detected from stinger that theres wanna cry too but failed to clean or delete using stinger

any suggest plan ?

installation logs in the attachment 

[AjaySundar · Accepted solution]

Hi @Dwee ,

Good day to you!

The ransomware interceptor would not be of help in this case. Can you confirm if the machine is patched with the latest Windows update? If not you can start off with that followed by updating the user account passwords. Run the stinger again reboot the machine and attempt the ENS installation.

I would request you to check if there are any services/process named eternal blue running on the machine, if it is then I would recommend you to re-image the machine as the malware would have damaged the machine also wouldn't allow any AV to be installed on the machine.

On a second note, you can also consider using the command line scanner for Windows. This helps to scan the complete machine with the latest DAT contents, which would help you in cleaning the machine. Since you have a license for ENS you should have the CMD scanner too, it is available for download from the McAfee product download site.

The instruction on how to use the product is available in the below article.

https://kc.mcafee.com/corporate/index?page=content&id=KB75478

You could run the scan even in safe mode without networking which is one of the best ways to clean the malware of the machine where an AV is not installed.

I hope this helps.

Thanks

AJ

[Dwee · Accepted solution]

Hi Ajay,

thx for your reply, can the cmd line scanner clean or detect virus or malware that slip stinger detection ? that will put cmd line scanner above stinger level am i right ?

i will try these "Can you confirm if the machine is patched with the latest Windows update? If not you can start off with that followed by updating the user account passwords. Run the stinger again reboot the machine and attempt the ENS installation" first, i'll get back here to inform you later,

Thanks again

Dwi

[ryadav1]

Hi , 

I dont think its a  ransomware, so McAfee ransomware interceptor not going to be of much use.

The primary recommendation here would be to update the Microsoft Security updates on the impacted box and then run then try Installing the ENS . That should help .

Thank you 

[Dwee]

Hi Ryadav ,

we have tried fix/patched windows up and so far we successful install the agent and the ENS, but some still can't install (some both agent and ens other agent only), and the one that installed agent and ens success to clean or delete the virus and other malicious, but there's some Trojan type in threat event that failed to delete or clean it, and we dont know why mcafee ens failed to delete ,clean or block these trojan, (target names: mssecsvr.exe, and functionprotocolhost.dll), mssecsvr.exe <-- isnt wannacry ?

amcore and dats all uptodate,

thanks