Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

NT AUTHORITY\SYSTEM McAfee/Windows 7


  • Please log in to reply

#1
Hockeytownryan

Hockeytownryan

    Member

  • Member
  • PipPip
  • 15 posts
I am not sure if this is where this belongs because the research I have done it could be a number of things.

I am shooting from the hip and will offer all the info I can.

I have a NEW PC running Windows 7 64 bit.
I have McAfee 8.7.0i running with anti-spyware module.

Everyday I boot up and log in and all is good. and everyday I get a series of Protection Log entries

And I get these messages a couple times a day...

Here is todays......


2/25/2010 12:48:17 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:48:17 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:48:17 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:48:18 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\Windows\system32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:48:18 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:48:18 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:48:18 PM Blocked by Access Protection rule NT AUTHORITY\LOCAL SERVICE C:\Windows\system32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:49:14 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:49:14 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:49:14 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:49:14 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:49:14 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
2/25/2010 12:49:15 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:49:15 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:59:18 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:59:19 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:59:19 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:59:19 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:59:19 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:59:19 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 12:59:19 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 1:36:54 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 1:36:54 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 1:36:54 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 1:36:54 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 1:46:52 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 1:46:52 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:47:24 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:47:30 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:58:02 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:58:02 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:58:03 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:58:03 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:58:03 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:58:03 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 2:58:03 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:45:15 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:45:16 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:45:16 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:45:16 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:45:16 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:52:12 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:52:12 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:52:13 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:52:13 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:52:13 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:52:13 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/25/2010 3:52:13 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate


Does anyone know how to interpret these Protection Log entries and if so, What does this mean?
To me this looks like it is picking It's own files up as a threat. I have disabled the Anti-Spyware module to see if that was the issue and It was not.

I do not know where to go from here. from articles I have been reading, NT AUTHORITY is not always a virus.

Edited by Hockeytownryan, 25 February 2010 - 03:37 PM.

  • 0

Advertisements


#2
kalju24

kalju24

    Member

  • Member
  • PipPip
  • 44 posts
Hello.
Seems like your antivirus is going mad but the svchost.exe is a pretty common thing where viruses hide themself.
First thing i would do is uninstall antivirus then read and try this http://www.geekstogo...uide-t2852.html should help about 70% of virus then reinstall antivirus tell me what happened then.
Sorry for my bad english it ain't my native language.

Edited by kalju24, 26 February 2010 - 01:22 AM.

  • 0

#3
Hockeytownryan

Hockeytownryan

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
Thank You for responding and the direction.

I downloaded the Anti-Malware and spyware stuff and It found one file that had been bugging me, Tho probably unrelated to my original Issue.

I did the first 3 steps in that tutorial and re-installed my Anti-virus and got a Log file before I rebooted the system

This is it.

2/26/2010 12:18:51 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/26/2010 12:18:51 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/26/2010 12:18:51 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/26/2010 12:18:51 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Windows\system32\mfevtps.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/26/2010 12:18:51 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

2/26/2010 12:18:52 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate


And of course I rebooted the system and Tried to Update my Anti Virus and it did not do so Sucessfully stating that the updates were not in the repository

soon as I hit the Update button this popped up on my Log File

2/26/2010 12:25:56 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM \??\C:\Windows\system32\conhost.exe C:\Program Files (x86)\McAfee\Common Framework\McScript_InUse.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

conhost? thats new and McScrpit_InUse.exe? Sounds like my Anti-Virus is combating its self.

Now what? should I carry on with the rest of the tutorial? I am not sure Its a virus. But thats why I am asking for help. I do not have the knowledge that is here.. Thank you for responding and the assistance.
  • 0

#4
Rorschach112

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
It would be a good idea to do the rest of the steps in the tutorial to be safe
  • 0

#5
kalju24

kalju24

    Member

  • Member
  • PipPip
  • 44 posts
Many viruses block microsoft and virus protection sites, so eah carry on with that
  • 0

#6
Hockeytownryan

Hockeytownryan

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
I have completely finished up all the tutorial page.

Updating Microsoft was never a issue. It was when I tried to Update my McAfee that I got the messages about updates not in the repository. the Protection log still got messages until I added "McAfee" folder to the exceptions portion of the scan properties and I have not had a Log File open since.

I suppose Ill never find out what caused those errors....but as long as it doesnt scan that folder I suppose the issue is that it was having issues with it's self. I still cannot update McAfee because the program will not update. that I suppose is another Issue for another thread.

I would like to thank all that responded an helped with my small problem. Thank You.

Ryan
  • 0

#7
kalju24

kalju24

    Member

  • Member
  • PipPip
  • 44 posts
Thank you for replyng back.
  • 0

#8
Hockeytownryan

Hockeytownryan

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
I did alot more searching in the McAfee forums for this problem and It IS a compatibility issue.

turns out a "patch 1" is in the works to fix this error with 64 bit systems.

I cannot thank those who helped me out enough and now.. at least I am clean of viruses..(if I had any)
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP