Microsoft Security Essentials suddenly not passing FirePass AV check

Hi Eric,

 

 

I think you'll need to update the OPSWAT SDK. You can check with F5 Support on this.

 

 

Aaron

Yes, the existing OPSWAT libraries do not recognize the new 4.0 engine. An update to OPSWAT will be released.

Oh this is rough. Checking for that update...

I installed hf-389948-1-7.0 dated May 4th and I still have users complaining. Looks like it didn't make this library update.

I think OPSWAT just released support for MSE 4.0 today or very recently. I expect F5 will have an update released based on this in the next week or so.

 

 

Aaron

Looking for feedback from others affected. I installed HF-386082-1 and while it detects Microsoft Security Essentials it cannot seem to identify the age of the database. Example:

 

 

\Session Variable%session.detected_av.av_2.agent_id%= ' OPSWAT_AV '

 

Session Variable%session.detected_av.av_2.data_version%= ' 1.0 '

 

Session Variable%session.detected_av.av_2.protect%= ' '

 

Session Variable%session.detected_av.av_2.update%= ' '

 

Session Variable%session.detected_av.av_2.need_update%= ' '

 

Session Variable%session.detected_av.av_2.expression_id%= ' '

 

Session Variable%session.detected_av.av_2.name%= ' MicrosoftAV '

 

Session Variable%session.detected_av.av_2.features%= ' 1 '

 

Session Variable%session.detected_av.av_2.engine_version%= ' 1.1.8304.0 '

 

Session Variable%session.detected_av.av_2.database_version%= ' 1.125.1774.0 '

 

Session Variable%session.detected_av.av_2.database_signature%= ' '

 

Session Variable%session.detected_av.av_2.database_time%= ' undefined '

 

Session Variable%session.detected_av.av_2.monitor%= ' enabled '

 

Session Variable%session.detected_av.av_2.last_scan%= ' 2012.05.14 03:52:26 '

 

Session Variable%session.detected_av.av_2.gui_state%= ' hidden '

 

Session Variable%session.detected_av.av_2.description%= ' Microsoft%20Security%20Essentials '

 

Session Variable%session.detected_av.av_2.database_age%= ' unknown '

 

Session Variable%session.detected_av.av_2.r_log_0%= ' Criteria failed - older than 10 days: unknown '

 

Session Variable%session.detected_av.av_2.r_log_1%= ' Criteria failed - older than 10 days: unknown '

 

Session Variable%session.detected_av.av_2.r_log_2%= ' Criteria failed - older than 10 days: unknown '

 

 

I checked a test box and its definitions were last updated today (5/14) at 0152 PDT.

Hi Michael, the database age check won't work until MS puts out an update for MSE. So right now it will detect it, but once and update from MS comes out, then the database age checks should work correct. As of right now, that feature is not supported by OPSWAT for this reason.

This was taken this morning with the following pattern files on the client :- 1.125.1826.0

 

 

 

Below is the result of a test trying to logon:-

 

 

 

Tue May 15 06:10:33 CEST 2012 notice 01490005 Following rule 'fallback' from item 'Antivirus Check Standalone' to ending 'Allow'

 

Tue May 15 06:10:33 CEST 2012 info 01490007 Session variable 'session.check_av.Teracom_Drift_VPN_act_av_check_2_ag.count' set to '1'

 

Tue May 15 06:10:33 CEST 2012 info 01490007 Session variable 'session.check_av.Teracom_Drift_VPN_act_av_check_2_ag.error' set to '0'

 

Tue May 15 06:10:33 CEST 2012 info 01490007 Session variable 'session.check_av.Teracom_Drift_VPN_act_av_check_2_ag.item_1.db_time' set to '0'

 

Tue May 15 06:10:33 CEST 2012 info 01490007 Session variable 'session.check_av.Teracom_Drift_VPN_act_av_check_2_ag.item_1.db_version' set to '1.125.1826.0'

 

Tue May 15 06:10:33 CEST 2012 info 01490007 Session variable 'session.check_av.Teracom_Drift_VPN_act_av_check_2_ag.item_1.failed_attr_chk_in_row_1' set to 'DB_AGE'

 

Tue May 15 06:10:33 CEST 2012 info 01490007 Session variable 'session.check_av.Teracom_Drift_VPN_act_av_check_2_ag.item_1.features' set to '1'

 

Tue May 15 06:10:33 CEST 2012 info 01490007 Session variable 'session.check_av.Teracom_Drift_VPN_act_av_check_2_ag.item_1.id' set to 'MicrosoftAV'

 

Tue May 15 06:10:33 CEST 2012 info 01490007 Session variable 'session.check_av.Teracom_Drift_VPN_act_av_check_2_ag.item_1.name' set to 'Microsoft Security Essentials'

 

Tue May 15 06:10:33 CEST 2012 info 01490007 Session variable 'session.check_av.Teracom_Drift_VPN_act_av_check_2_ag.item_1.state' set to '1'

 

Tue May 15 06:10:33 CEST 2012 info 01490007 Session variable 'session.check_av.Teracom_Drift_VPN_act_av_check_2_ag.item_1.ui' set to '0'

 

Tue May 15 06:10:33 CEST 2012 info 01490007 Session variable 'session.check_av.Teracom_Drift_VPN_act_av_check_2_ag.item_1.vendor' set to 'Microsoft Corp.'

 

Tue May 15 06:10:33 CEST 2012 info 01490007 Session variable 'session.check_av.Teracom_Drift_VPN_act_av_check_2_ag.item_1.version' set to '1.1.8304.0'

 

Tue May 15 06:10:33 CEST 2012 info 01490007 Session variable 'session.check_av.Teracom_Drift_VPN_act_av_check_2_ag.result' set to '0'

 

Tue May 15 06:10:33 CEST 2012 info 01490007 Session variable 'session.check_av.Teracom_Drift_VPN_act_av_check_2_ag.sdk' set to '3.5.1285.2'

 

Tue May 15 06:10:33 CEST 2012 info 01490007 Session variable 'session.check_av.Teracom_Drift_VPN_act_av_check_2_ag.state' set to '0'

 

 

 

 

And unfortunately it still does not work.

 

 

 

/Craig

 

I Have now tried running the OesisDiagnose_V3.exe tool on the client PC and result is below, it seems to detect the DB versions and the signature files:-

Strange thing is that just when it starts to check VPN clients the program crashes.

 

Anyone else tried this on Windows 7 with sp1 ?

 

 

[AuthenticResult=0,

 

Path="C:\Windows\system32\DRIVERS\MpFilter.sys"]>,

 

IsProductAuthentic=0]

 

GetDataFileVersion, Result: OK Value: "1.125.1826.0"

 

GetDataFileSignatures, Result: Not implemented

 

CheckRTP, Result: OK Value: True

 

GetEngineVersion, Result: OK Value: "1.1.8304.0"

 

GetDataFileTime, Result: Not implemented

 

GetLastFullSystemScanTime, Result: OK Value: 2012/5/2 23:34:9

 

IsFullSystemScanInProgress, Result: Not implemented

 

GetDataFileDir, Result: OK Value: <"c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C35AAEB2-29F3-49E5-965A-64FC59501F0E}">

 

GetRTPExcludedPaths, Result: Not implemented

 

GetRTPExcludedExtensions, Result: Not implemented

 

GetRTPThreatAction, Result: Not implemented

 

GetFullScanThreatAction, Result: Not implemented

 

 

/Craig

 

I think i forgot to mention that iam running on APM version 10.2.2 HF1 at the moment and the update does not seem to work there either.

 

 

/Craig