threat - query

hello,

need to pick someones brains.

my antibot has changed its configuration from 199 > 201, so im guessing there was an update somewhere.

today, it popped up automatically with a threat.

....related to McAfee?

im on my new-latest laptop here, and the only Mcafee this machine has ever had, is from all the pre-installed stuff that was installed on it, which im supposed to have removed, and with Your Uninstaller! 2008.

ive never had any pop ups till now,




but is mcafee still phoning home on my machine?

 

Hello C.S.J,

Provided that the file in question(MCUPDATE.EXE) checks out as clean by Dr.Web, VirSCAN(http://www.virscan.org/) or VirusTotal(http://www.virustotal.com/), chances are good that this is a false positve on NAB's part. Assuming that this is the case, all you need to do is restore this file from quarantine, report this fp to (support [at] sanasecurity [dot] com);(*Note: Include the checksum of MCUPDATE.EXE) and permanently delete it if you so choose. Hope this helps.


Peace & Gratitude,

CogitoErgoSum

 

I don't know what that thing does, but I've had cases when that file remained after the uninstallation of McAfee in some machines (I think the machines had viruscan enterprise 2004). However, since it is related to McAfee, I think it won't harm removing it.

 

yep, i have no problem removing it.

i just think its a little cheeky to leave an update file that phones home on my machine.

if not for antibot, i wouldn't have known about this unwanted process.

 

Chris,

I use NIS 2008 at times, my question is how "light" is Anti-Bot on your machine as say compared to Prevx?

 

i dont notice either of them on my machine, whenever ive used them.

AB is very light.

 

I'll give AB a try.

 

Shouldn't your software firewall have noticed this?
ellison

 

probably, if i used one

 

Ahh i see.....How has antibot performed for you?.I noticed its licensed technology from sana however their version is about 3 times the price that symantec is selling it for (for UK buyers anyway).Have you had any problems with it?.I dont like threatfire so im looking for something like this thats more stable.
ellison

 

its fine,

i own many types of those kinda programs, and i think they are all great.

so really, cant do much comparing.

 

Good to hear.....Will antibot continue to function if licence isnt renewed?.I know you woulnt get upgrades but i guess the current version would still work fine?
ellison

 

no idea, but i highly doubt it.

im guessing it would be greyed out (tray icon) with a highlighted message saying protection has expired.

 

Are you sure this is related to McAfee ? mcupdate.exe (in vista ) is one of windows process :

http://www.greatis.com/vista/Utilities/m/mcupdate.exe.htm

 

so MC stands for Media Center?
But in some machines (xp) it was mcafee's update. This could also be verified by the mcafee icon appearing sometimes in the taskbar, which would disappear immediately if the mouse would hover on it.

 

To make it even lighter, check the monitored programs with non-green rating squares. Google around when you trust them, manually allow them.

Regards Kees

 

The retail version of McAfee used to leave mcupdate_some_random_digits.exe in startup. I'm not sure about the latest versions. But the file name always had some random numbers. Its the same trick used by antirootkit programs to avoid directed attacks from rootkits.

 

Probs a false positive, remember antibot is heuristic detection.

 

For what it's worth, I have seen other McAfee products (firewall) leave pieces of itself behind after an uninstall, and actually leave drivers loaded with reg entries and so on, so I would not be surprised that the AV left stuff behind also.