xDAT installs failing on newer signatures

[Former Member]

About two weeks ago new xDAT updates started failing on all of my clients with VSE 8.8.  When I try to apply any new xdat file, I get a message saying "Error: unable to backup existing file.  Not enough rights: Line 12."  I also see events generated in the On-Access Protection logs saying that the attempt to write to the ..\MCAFEE\ENGINE\OLDDATS\ folder was blocked with the reason being "Prevent Modification of McAfee Scan Engine Files and settings by untrusted default processes."   I tried turning off the Block settings for all of the items in the Access Protection Common Standard Protection, but I still see the block.  I also saw the previous suggestions to update the root certs using the USERFirst_and_Verisign_and_Comodo_and_GlobalSign bat and registry files, which I've done.  After installing, I rebooted and verified that the certificates got added to my Third Party Trusted Root and Intermediate Root cert stores.  Problem still persists.

All of these systems are standalone.  I see it on both Windows 7 and Windows 10 clients.  All are currently at patch 11, as we don't have approval to go to patch 13 yet.

[Former Member · Accepted solution]

UPDATED

I found a work around (if you want to call it that).
Inspite of dissabling everything you can in Access Protection it still blocks install.....while the McAfee Validation Trust Protection Service" is running.

You cant stop this service in services concole or using command line.
To stop it you need to first turn off access protecetion and uncheck Prevent McAfee services from being stopped"
Then go to help, repair installation and select to repair all settings
The VSE Console window should close, reopen it after a few seconds
After a few more seconds should get an error about McAfee Task Manger and the window will close
Wait another 10-30 seconds and both McAfee Task Manager and McAfee Validution Trust Protection Service should now be off.
Now you can run your xdat.exe file to update deffinitions
Once complete, reopen virus scan console, give it about 30-40 seconds and should see proper dat file in the about information
Martha Stuewart would say "Its just that easy!"

Long term, going to need your organization to get to patch 13

[Former Member]

Thank you! Appreciate the workaround.

[Former Member]

Thank you for this "workaround". We have been having this issue for a long time. Just updated without any issues after going through this process! Awesome!!!

[Hutchirg]

Where is this located? "To stop it you need to first turn off access protection and uncheck Prevent McAfee services from being stopped" Where is this DONE? I don't no where to locate access protection.

[Former Member]

Are you accessing the console as an Admin?

[Former Member]

In the Virus Scan Console. Hit the windows windows key and start typing Virus Scan Console. You might need to run as admin and also unlock the interface if it is password protected ( Tools>Unlock ). Once it's accessible, right click access protection and go to properties.

[Hutchirg]

Thanks for the instructions, I done that and it's still no working for me. any other suggesting would be appreciated.

Thanks in Advance! 

[DtotheAN]

Can confirm this method still works on Patch 16. except after installing the xdat.exe, i then had to complete another repair of the installation from the help menu.