NAI Anti-Virus problem with dat 4367

 

For the latest info see www.nai.com

 

FOR MY ADVICE CLICK HERE

 

This is what they had posted on the 17-06-04….

June 17 2004

The 4.1.60 Engine is Out of Date and No Longer Supported

The notice below addresses two separate issues tracked and brought to resolution by McAfee AVERT and Support as they pertain to the 4.1.60 and 4.3.20 Engines

Scenario 1
The 4.1.60 Engine was officially EOL (End of Life) at the end of August 2003 and is no longer supported. With the release of the 4367 DATs, on Wednesday June 16, 2004, customers began to notify AVERT and Network Associates Support of machines failing to initialize after installing or updating to the 4367/4.1.60 configuration. The two components are not compatible and the 4.1.60 engine needs to be removed and an update needs to take place to the 4.3.20 engine.

This has been documented and you can get more information by reading our Primus Articles listed below. 

  • NAI37284 – NNT45 HFR Error Messages
  • NAI37282 – Command Line Scanner Error Messages
  • NAI37288 – VSC451SP1 Error Messages
  • NAI37289 – VTC 6.1 Error Messages
  • NAI37294 – GSE 5.0/5.2 Error Messages

It is possible for the other command line shells (i.e. scan.exe, bootscan.exe, scan85.exe) to also cause the same type of issue if these shells are 4.1.60.

If you experience this problem and are certain you have the 4.1.60 engine still installed you should use the SuperDAT to update to the 4.3.20 engine immediately.  You can download the engine updates from: click here 

Scenario 2
Today some customers who are running the 4.3.20 engine with VirusScan 4.51 SP1 and Windows 9x also experienced the same initialization failure as those running the 4.1.60 engine.

After further analysis of the issue, it has been determined that when an engine upgrade was performed via an ePolicy Orchestrator (ePO) task, all command line shells were installed with the exception of ScanPM. 

This could lead to a boot failure and/or systems hang time if ScanPM was initialized from the autoexec.bat. 

The conditions that must be true for this issue to occur are:
a.       Running Windows 9.x
b.       Using VirusScan 4.5.1
c.       Managing VirusScan updates through ePO and CMA
d.       Never deployed a SuperDAT through ePO

If you have a system that will not boot due to the autoexec.bat initialization error please click here to download a batch file that can be used to help resolve this problem; delete the 4.1.60 ScanPM and install the 4.3.20 ScanPM. Using the batch file this is done as follows:

1.        Copy the batch file (scanfix.bat) to a floppy disk

2.        Boot the failing machine in safe mode

3.        Execute the batch file from the floppy disk on the failing machine  (This will delete the 4.1.60 version of scanpm.exe from the system)

4.        Reboot the machine

5.        As the machine boots you will receive a message “Not enough memory to run SCAN86.exe” Hit return and continue past the message. This message will not appear, on subsequent boots, after you have performed step “6”

6.        Once the machine has completed booting download and deploy the latest SuperDAT to it, as described below.This will install the 4.3.20 version of scanpm.exe and the problem is resolved.

Alternatively, if you have a system that meets the above, and will boot, you can download the latest SuperDAT to update your 4.1.60 ScanPM engine to the 4.3.20 ScanPM engine.  You may need to “force option" (aka /f) the SuperDat to be effective.  You can download the SuperDat package here.

 

 

 

MY ADVICE.

This is what I have found so far….

The problem can affect all machines running NAI 4.5 software; this includes windows 9x, NT4, AND GROUPSHIELD!!!!!

Click HERE to download the latest Sdatxxxx.exe file from NAI

If you have a 9x PC that won’t boot (hangs at the dos scan), then you need to…..

·         Boot the PC from a floppy disk or press F8 and select ‘Safe mode Command Prompt’

·         Type ‘c:\windows\command\edit c:\autoexec.bat’

·         Place a ‘rem’ before the 2 Anti-Virus statements

·         Save and exit, remove the floppy disk and reboot normally.

·         If you can get to the desktop and the PC doesn’t ‘hang’; then force an update by running ‘Sdat4367.exe /F’

 

·         If the PC ‘hangs’ once it is at the desktop, do the following…

·         Reboot and again press F8

·         Select safe mode

·         Rename ‘C:\program files\Network Associates’ to ‘Network Associates.old’

·         Reboot to normal desktop

·         Rename ‘C:\program files\Network Associates.old’ back to ‘Network Associates’

·         Force an update by running ‘Sdat4367.exe /F’

 

If you have an NT4 Server with 4.5 installed then you need to check all the Anti-Virus services are running. You may need to stop the Auto-Update service before you can restart the main Anti-Virus service.

Once all services are running, force an update with the ‘Sdat4367.exe /F’