EICAR test for MOVE AntiVirus Multi-Platform fails due to RAM drive scanning by another product

Technical Articles ID: KB90004
Last Modified: 7/24/2018

Environment

McAfee Management for Optimized Virtual Environments (MOVE)
McAfee MOVE AntiVirus Multi-Platform (MOVE AV Multi-Platform) 4.x.x
McAfee VirusScan Enterprise (VSE) 8.8.x

For details of MOVE supported environments, see KB74865.
For details of VSE 8.x supported environments, see KB51111.

Summary

EICAR test files are used to validate a virtual machine's protection status. When MOVE AV Multi-Platform is installed, an EICAR test is executed on a protected system. This test causes the file to be copied to X:\ drive, which is the default location on the SVM, and then scanned by the local MOVE Server.

This article provides information about what causes these EICAR tests fail and the steps to take when they fail.

NOTE: You must ensure that the file type used in the EICAR test is being scanned. By default, text (.txt) files are not scanned. Either the policy needs to be updated to allow for scanning of .txt files or a different scanned file type, such as .com, must be used. See KB59742 for additional information about performing an EICAR test.

Problem

A new instance of MOVE AV Multi-Platform 4.x has been deployed (new environment setup), and the EICAR test fails even though the client shows a successful connection to the scan server.

The mvagent logs on the client system show that the file is successfully delivered to the scan server. The mvserver logs on the SVM do not show scan activity.

Problem

An upgrade from a MOVE AV Agentless environment to a MOVE AV Multi-Platform environment is being performed. Both are up and running concurrently in the same virtual space. MOVE AV Agentless is functioning correctly, but EICAR tests fail on the virtual machines protected by MOVE AV Multi-Platform even though the client shows a proper connection to the SVM.

The mvagent logs on the client system show that the file is successfully delivered to the scan server. The mvserver logs on the SVM do not show scan activity. Below are examples of what you see in the relevant logs, when DEBUG logging is enabled:

Client log (mvagent.log):
K.5844.6012: Oct 30 2017:11:55:56.579: FNENTRY: utl_kern_winnt.c: 1152: win32 VOLUME NAME for file 'C:\EICAR.txt' => [\Device\HarddiskVolume1\EICAR.txt].
K.5844.6012: Oct 30 2017:11:55:56.579: DETAIL: scan.c : 1770: Cache miss for file with filename: \Device\HarddiskVolume1\EICAR.txt
K.5844.6012: Oct 30 2017:11:55:56.579: DETAIL: scan.c : 4515: Skipping PTSA check for non PE file \Device\HarddiskVolume1\EICAR.txt
K.5844.6012: Oct 30 2017:11:55:56.579: DETAIL: scan.c : 3348: Value of tie_enabled: [0] with tie_action: [0], value of pe_file: [2] for file: \Device\HarddiskVolume1\EICAR.txt
K.5844.6012: Oct 30 2017:11:55:56.579: INFO: scan.c : 3461: Going for a cksum lookup for cksum: 3395856ce81f2b7382dee72602f798b642f14140

SVM log (mvserver.log):
U.2216.3296: Oct 30 2017:11:55:56.766: INFO: avs_server.c: 750: [SCAN FLOW] Received request for file ( \Device\HarddiskVolume1\EICAR.txt ) size ( 68 )
U.2216.0684: Oct 30 2017:11:55:56.797: DETAIL: svc_socket.c: 836: 192.168.104.40: Received request with mes ID: CKSUM, Protocol version: 8
U.2216.0684: Oct 30 2017:11:55:56.860: DETAIL: svc_socket.c: 3511: 192.168.104.40: Received checksum request for aad1313958ce3618d5ec3a227a9729503f55a177
U.2216.0684: Oct 30 2017:11:55:56.875: DETAIL: svc_socket.c: 1069: 192.168.104.40: Sent response for cksum request ( aad1313958ce3618d5ec3a227a9729503f55a177 ) resp ( 2 )
U.2216.0684: Oct 30 2017:11:55:56.907: INFO: svc_socket.c: 2133: Processed req: CKSUM, from 192.168.104.40, for file: of size: 0 with cksum: aad1313958ce3618d5ec3a227a9729503f55a177. cksum resp: CLEAN, File scan resp: UNKNOWN, err code: 0. total req time: 0.110261 sec, thread wait time: 0.000009 (s).
U.2216.0684: Oct 30 2017:11:55:56.953: DETAIL: svc_socket.c: 836: 192.168.104.40: Received request with mes ID: FILE, Protocol version: 8
U.2216.3296: Oct 30 2017:11:55:56.953: ERROR: avs_server.c: 915: [SCAN FLOW] Failed to calculate cksum of file: [\\?\X:\McAfee\MOVE AV Server\scanfiles\2232\EICAR.txt], err: [2], err_text: [No such file or directory].
U.2216.3296: Oct 30 2017:11:55:57.078: ERROR: svc_socket.c: 1802: 192.168.104.40: Failed to get file: \Device\HarddiskVolume1\EICAR.txt, err: -1

Cause

Problem 1 cause:
VSE is engaging the EICAR test file before MOVE AV Multi-Platform can engage.

Problem 2 cause:
If the MOVE AV Multi-Platform SVM resides on a MOVE AV Agentless protected host and has the Introspection driver loaded, MOVE AV Agentless engages the EICAR test file before MOVE AV Multi-Platform or VSE can engage.

Solution

If you are experiencing the issue described in Problem 1, check the VSE On Access Scan (OAS) log on the SVM. If action on the EICAR test file is indicated, see KB58692 and follow the steps to make mvserver.exe a Low Risk process exclusion.

Solution

If you are experiencing the issue described in Problem 2, verify that the VMware Introspection driver has been removed from both the client and the SVM.

Affected Products

Configuration
Known Issue/Product Defect

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

EICAR test for MOVE AntiVirus Multi-Platform fails due to RAM drive scanning by another product

Environment

Summary

Problem

Problem

Cause

Solution

Solution

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

EICAR test for MOVE AntiVirus Multi-Platform fails due to RAM drive scanning by another product

Environment

Summary

Problem

Problem

Cause

Solution

Solution

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title