FramePkg
  • Home
  • About
  • Procedures
    • ePO Upgrade
    • ePO Architecture
    • BackUp ePO
    • How To Uninstall McAfee Client Manually
    • McAfee Drive Encryption
    • TIE Guide - A to Z Steps
  • ePO
  • VSE
  • DLP
  • HIPS
  • Solutions
  • Tips
  • Videos
  • Online Updates

McAfee move multiplatform 4.x failed to delete infected file

15/5/2018

0 Comments

 
McAfee ePO 5.3.x, 5.9.x
McAfee MOVE MultiPlatform 4.5.1, 4.61

Issue:

Infected Files are no deleted by McAfee MOVE

error:

​U.1428.2852: May 15 2018:11:09:24.531:   ERROR: svc_socket.c: 2028: IP: Failed to send SMART FILE response ( \Device\HarddiskVolume3\McAfee\ePO\591\EPO591L.zip ) (  ) err ( 10053 )

U.1428.2652: May 15 2018:11:10:09.531:   ERROR: svc_socket.c:  274: socket send failed(err: WSAECONNABORTED = 10053), Client has closed the connection (may be due to Timeout).

U.1428.2652: May 15 2018:11:10:09.531:   ERROR: avs_server.c: 1130: write_scan_resp_based_on_protocol failed: 10053

U.1428.2652: May 15 2018:11:10:09.531:   ERROR: avs_server.c: 1406: avs_write_scan_response failed. err: 10053

U.1428.2652: May 15 2018:11:10:09.531:   ERROR: svc_socket.c: 2028: IP: Failed to send SMART FILE response ( \Device\HarddiskVolume3\McAfee\ePO\591\EPO591L.zip ) (  ) err ( 10053 )

U.1428.2612: May 15 2018:11:10:31.844:   ERROR: avs_server.c:  915: [SCAN FLOW] Failed to calculate cksum of file: [\\?\X:\McAfee\MOVE AV Server\scanfiles\2284\shay - Copy.txt], err: [13], err_text: [Permission denied]. 

U.1428.2612: May 15 2018:11:10:31.844:   ERROR: svc_socket.c: 1802: IP: Failed to get file: \Device\HarddiskVolume2\Users\shay.a\Desktop\shay - Copy.txt, err: -1

U.1428.3980: May 15 2018:11:10:44.906:   ERROR: avs_server.c:  915: [SCAN FLOW] Failed to calculate cksum of file: [\\?\X:\McAfee\MOVE AV Server\scanfiles\2468\shay - Copy - Copy.txt], err: [13], err_text: [Permission denied]. 

U.1428.3980: May 15 2018:11:10:44.906:   ERROR: svc_socket.c: 1802: IP: Failed to get file: \Device\HarddiskVolume2\Users\shay.a\Desktop\shay - Copy - Copy.txt, err: -1

U.1428.1240: May 15 2018:11:10:48.406:   ERROR: avs_server.c:  915: [SCAN FLOW] Failed to calculate cksum of file: [\\?\X:\McAfee\MOVE AV Server\scanfiles\2548\$RG4Y2O9.txt], err: [13], err_text: [Permission denied]. 

U.1428.1240: May 15 2018:11:10:48.406:   ERROR: svc_socket.c: 1802: IP: Failed to get file: \Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-854873570-2405677725-3658187990-1382\$RG4Y2O9.txt, err: -1

U.1428.1132: May 15 2018:11:10:54.532:   ERROR: svc_socket.c:  274: socket send failed(err: WSAECONNABORTED = 10053), Client has closed the connection (may be due to Timeout).

U.1428.1132: May 15 2018:11:10:54.532:   ERROR: avs_server.c: 1130: write_scan_resp_based_on_protocol failed: 10053

U.1428.1132: May 15 2018:11:10:54.532:   ERROR: avs_server.c: 1406: avs_write_scan_response failed. err: 10053

U.1428.1132: May 15 2018:11:10:54.532:   ERROR: svc_socket.c: 2028: IP: Failed to send SMART FILE response ( \Device\HarddiskVolume3\McAfee\ePO\591\EPO591L.zip ) (  ) err ( 10053 )
​
Solutions:

Exclude the process "mvserver.exe" from Virus Scan scan on the Scan Server(SVM)

1 Log on to McAfee ePO as an administrator.
2 Select Menu | Policy | Policy Catalog, select VirusScan Enterprise 8.8 from the Product drop-down list, then select On-Access Low-Risk Processes Policies from the Category drop-down list.
3 Duplicate the On-Access Low-Risk Processes Policies policy.
4 Open the duplicate On-Access Low-Risk Processes Policies policy and configure these options. • Settings for — Select Server. • From the Low-Risk Processes tab, add mvserver.exe to the Low-Risk Processes list. • From the Scan Items tab, next to Scan files, disable When writing to disk and When reading from disk.
5 Click Save and assign the policy to the SVMs.
6 Select Menu | Policy | Policy Catalog, select VirusScan Enterprise 8.8 from the Product drop-down list, then select On-Access Default Processes Policies from the Category drop-down list. 
7 Duplicate the On-Access Default Processes Policies policy.
8 Open the duplicate On-Access Default Processes Policies policy and configure these options. • Settings for — Select Server. • From the Low-Risk Processes tab, next to Process Settings, select Configure different scanning policies for high-risk, low-risk, and default processes.
9 Click Save and assign the policy to the SVMs.

0 Comments
    Picture
    View my profile on LinkedIn

    Categories

    All

    Ebates Coupons and Cash Back

    Archives

    May 2018
    July 2016
    June 2016
    May 2016
    January 2016
    May 2015
    March 2015

    Action Coin
    Buy me a coffee:)