Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

NT AUTHORITY\SYSTEM McAfee/Windows 7

Started by Hockeytownryan , Feb 25 2010 03:35 PM

  • Please log in to reply

#1
Hockeytownryan
Posted 25 February 2010 - 03:35 PM

Hockeytownryan

    Member

  • Member
  • PipPip
  • 15 posts
I am not sure if this is where this belongs because the research I have done it could be a number of things.

I am shooting from the hip and will offer all the info I can.

I have a NEW PC running Windows 7 64 bit.
I have McAfee 8.7.0i running with anti-spyware module.

Everyday I boot up and log in and all is good. and everyday I get a series of Protection Log entries

And I get these messages a couple times a day...

Here is todays......


2/25/2010 12:48:17 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:48:17 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:48:17 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:48:18 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\Windows\system32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:48:18 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:48:18 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:48:18 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:49:14 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:49:14 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:49:14 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:49:14 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:49:14 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/25/2010 12:49:15 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:49:15 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:59:18 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:59:19 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:59:19 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:59:19 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:59:19 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:59:19 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:59:19 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 1:36:54 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 1:36:54 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 1:36:54 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 1:36:54 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 1:46:52 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 1:46:52 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:47:24 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:47:30 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:58:02 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:58:02 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:58:03 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:58:03 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:58:03 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:58:03 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:58:03 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:45:15 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:45:16 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:45:16 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:45:16 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:45:16 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:52:12 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:52:12 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:52:13 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:52:13 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:52:13 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:52:13 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:52:13 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate


Does anyone know how to interpret these Protection Log entries and if so, What does this mean?
To me this looks like it is picking It's own files up as a threat. I have disabled the Anti-Spyware module to see if that was the issue and It was not.

I do not know where to go from here. from articles I have been reading, NT AUTHORITY is not always a virus.

Edited by Hockeytownryan, 25 February 2010 - 03:37 PM.

  • 0

Advertisements

#2
kalju24
Posted 26 February 2010 - 01:12 AM

kalju24

    Member

  • Member
  • PipPip
  • 44 posts
Hello.
Seems like your antivirus is going mad but the svchost.exe is a pretty common thing where viruses hide themself.
First thing i would do is uninstall antivirus then read and try this http://www.geekstogo...uide-t2852.html should help about 70% of virus then reinstall antivirus tell me what happened then.
Sorry for my bad english it ain't my native language.

Edited by kalju24, 26 February 2010 - 01:22 AM.

  • 0

#3
Hockeytownryan
Posted 26 February 2010 - 11:38 AM

Hockeytownryan

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
Thank You for responding and the direction.

I downloaded the Anti-Malware and spyware stuff and It found one file that had been bugging me, Tho probably unrelated to my original Issue.

I did the first 3 steps in that tutorial and re-installed my Anti-virus and got a Log file before I rebooted the system

This is it.

2/26/2010 12:18:51 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/26/2010 12:18:51 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/26/2010 12:18:51 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/26/2010 12:18:51 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/26/2010 12:18:51 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/26/2010 12:18:52 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate


And of course I rebooted the system and Tried to Update my Anti Virus and it did not do so Sucessfully stating that the updates were not in the repository

soon as I hit the Update button this popped up on my Log File

2/26/2010 12:25:56 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM \??\C:\Windows\system32\conhost.exe C:\Program Files (x86)\McAfee\Common Framework\McScript_InUse.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

conhost? thats new and McScrpit_InUse.exe? Sounds like my Anti-Virus is combating its self.

Now what? should I carry on with the rest of the tutorial? I am not sure Its a virus. But thats why I am asking for help. I do not have the knowledge that is here.. Thank you for responding and the assistance.
  • 0

#4
Rorschach112
Posted 26 February 2010 - 12:19 PM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
It would be a good idea to do the rest of the steps in the tutorial to be safe
  • 0

#5
kalju24
Posted 27 February 2010 - 04:37 AM

kalju24

    Member

  • Member
  • PipPip
  • 44 posts
Many viruses block microsoft and virus protection sites, so eah carry on with that
  • 0

#6
Hockeytownryan
Posted 27 February 2010 - 03:32 PM

Hockeytownryan

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
I have completely finished up all the tutorial page.

Updating Microsoft was never a issue. It was when I tried to Update my McAfee that I got the messages about updates not in the repository. the Protection log still got messages until I added "McAfee" folder to the exceptions portion of the scan properties and I have not had a Log File open since.

I suppose Ill never find out what caused those errors....but as long as it doesnt scan that folder I suppose the issue is that it was having issues with it's self. I still cannot update McAfee because the program will not update. that I suppose is another Issue for another thread.

I would like to thank all that responded an helped with my small problem. Thank You.

Ryan
  • 0

#7
kalju24
Posted 01 March 2010 - 12:09 AM

kalju24

    Member

  • Member
  • PipPip
  • 44 posts
Thank you for replyng back.
  • 0

#8
Hockeytownryan
Posted 01 March 2010 - 09:24 AM

Hockeytownryan

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
I did alot more searching in the McAfee forums for this problem and It IS a compatibility issue.

turns out a "patch 1" is in the works to fix this error with 64 bit systems.

I cannot thank those who helped me out enough and now.. at least I am clean of viruses..(if I had any)
  • 0
Back to Windows Vista and Windows 7 · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Retired Forums
  3. → Windows Vista and Windows 7

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP