McAfee Related Question

[shelquis]

Hi, I receive Spybot notices throughout the day that it has allowed a change. Spybot seems to be doing its job. I'm just wondering if any other McAfee users have noted the same behavior and, if so, is there a fix? The messages are identical, except the file name in one is all lower case, the other has some caps, and it just goes back and forth between the two. Here's a copy of the last two:

"6/13/2006 1:58:46 PM Allowed value "MCUpdateExe" (new data: "C:\PROGRA~1\mcafee.com\agent\McUpdate.exe") changed in System Startup global entry!
6/13/2006 2:25:40 PM Allowed value "MCUpdateExe" (new data: "c:\PROGRA~1\mcafee.com\agent\mcupdate.exe") changed in System Startup global entry!"

Perhaps this is intended behavior, but maybe not. I just thought I'd check and see if any other McAfee users have noticed the same behavior. Thanks.

[md usa spybot fan]

McAfee appears to re-add the startup entry for mcupdate.exe periodically (although it primarily occurs at system startup/logon). I have done an "Allow Change" with a "Remember this decision" to allow the following regisry change to be automatically accepted by TeaTimer went the change is encountered:


HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MCUpdateExe=C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
There is also another McAfee entry that I have done an "Allow Change" with a "Remember this decision" on:


HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\CleanUp=C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup

[shelquis]

But you still get a notification when it occurs, and an entry in the log, right?

[md usa spybot fan]

Yes.

You get notification message in the following format:


Resident

hh:mm Registry change allowed

Resident allowed the change of MCUpdateExe (category System Startup global entry) based on your white list
And a Log entry in the following format:


mm/dd/yyyy hh:mm:ss xM Allowed value "MCUpdateExe" (new data: "c:\PROGRA~1\mcafee.com\agent\mcupdate.exe") added in System Startup global entry!

[shelquis]

OK, so I apparently approved it with memory also, 'cause those are the same notifications I get too. Thanks.

[kc2lvh]

How do I get spybot to remember to allow the registry change each time? I get the message every 5 minutes sometimes. There is no "remember this decision" on the message.

[md usa spybot fan]

kc2lvh:

Are you getting dialog message that must be answered?
Spybot - Search & Destroy

Spybot - Search & Destroy has detected an important registry entry that has been changed.

Category:
Change:
Entry:
Old data:
New data:
Or a notification message in the lower right hand corner of the screen?
Resident

hh:mm Registry change allowed

[kc2lvh]

The error message is entitled "StartupMonitor Warning"
and reads:

MCUpdateExe
has registered the executable
c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
to run at system startup.
Do you wish to allow this change?

[md usa spybot fan]

kc2lvh:

That is not a Spybot/TeaTimer message!

Are you using some software like Mike Lin's "StartupMonitor"?
Mike Lin's Home Page
http://www.mlin.net/
Mike Lin's StartupMonitor
http://www.mlin.net/StartupMonitor.shtml