VSE 8.8. 6807 DAT problem - urgent!

[brentil]

Do NOT trust those numbers.  I've had to build 2 sets of reports to actually track this.  I've seen an odd mix of correct DAT version #s when 6809 deploys to the systems however the Engine Version is still 0.0000 and those machines are still impacted.  I suggest making another report that just looks for Engine Version = 0 to find those systems.

[Former Member]

If your machines are pulling the avvdat-6809.zip as part of the failed update then they will start to report the correct dat and engine version (which is why you count is dropping)

Be careful though these machines might report the correct DAT but sometimes the 'On-Access Scanner' will fail to start which means your AV isn't running.

[Former Member]

I'm with you on this one...gotta love it

[Former Member]

Well done Mcafee Muppets and sending out yet another untested DAT update. It beggars belief. Seven years I have had to use this and all the major issues have been self inflicted by duff DAT files.

[brentil]

Of note ALL of my Windows 8 VSE 8.8 P2 systems were impacted by this immediately.  Once they got 6809 and were rebooted they "seem" to be functioning correctly.  Of all our other Windows systems we seem to have about 20 out of 350 impacted by the failed DATs & engines.

[Former Member]

We have around 2,800 systems that are experiencing the exact issues stated in the KB76004 article. I have tried manually installing 6809 but the registry entires were still out of sync as well as On-Access not starting. I was able to follow the suggestion of copying the avvclean.dat, avvnames.dat and avvscan.dat to an effected system and after restarting the services, it looked good after the update to 6809. I heard from my McAfee sales engineer that the superdat should be released before noon today.

I also noticed that once 6809 installed, the dat version was properly displayed within ePO but the engine still shows 0.000.

Message was edited by: ddamico2004 on 8/20/12 9:48:12 AM CDT

[brentil]

Good, I really hope it is.  I'm going to deploy it to all of our systems even if they show as having issues or not because who knows what other misc side effects might be still lingering on machines reporting as being ok that were previously impacted.

[rdasso]

Confirmed: Full uninstall and re-install will resolve the issue. (Make sure the corrupt DAT files are removed before re-installing)

I would caution anyone who see's the number of 0.0000 DATs dropping. We have a number of confirmed cases where ePO is showing 6809 but OAS fails to detect EICAR... this confirms what the KB says about OAS appearing to be okay when it isn't.

Test with EICAR to be sure you're protected!

[Former Member]

rdasso wrote:
 Confirmed: Full uninstall and re-install will resolve the issue. (Make sure the corrupt DAT files are removed before re-installing)
I would caution anyone who see's the number of 0.0000 DATs dropping. We have a number of confirmed cases where ePO is showing 6809 but OAS fails to detect EICAR... this confirms what the KB says about OAS appearing to be okay when it isn't. 
Test with EICAR to be sure you're protected!

Out of interest, what warnings/errors were in the Application Log of a sample machine?

[twenden]

Anyone got news on when the SuperDat to fix this issue will be released?  Luckily for us we only has about 70 systems out of 2100 with the majority being fixed by uninstalling/installing VSE 8.8i. Had to make some special trips to two high profile users, one who is a lawyers, whose system would not fix itself via ePO. On these 2 systems the VSE showed the on-access scanner as being disabled. This is shocking as it would leave these systems open to viruses.  Where will this superDat get posted when released?