Re: SP2 breaks antivirus software

Tech-Archive recommends: Speed Up your PC by fixing your registry

From: Edwin Davidson (edavid3001_at_primeinc.com)
Date: 08/12/04 

Date: 12 Aug 2004 08:50:51 -0700

#1) FTP issue. CA uses ACTIVE FTP. We currently use this internally
through our networks firewall, and it works fine. There is an option
to switch to PASV, but it requires A) A patch to be installed, and b)
a registry hack. Both ZoneAlarm and Sygate function fine using ACTIVE
FTP. The XP SP2 firewall did not prompt me to allow this Active FTP
connection. It did prompt me for many other things, such as if I
wanted my SMTP server to continue to accept incoming e-mail (This is a
development box, the SMTP is my own coding.) Which was impressive.
It asked if I wanted to allow other things, and it did ask me if I
wanted to allow INODIST to connect, which I said yes. You can see the
initial FTP connection, but when the PORT command is issued, the XP FW
stops it. So I would say your assumption is correct. The problem is
these are remote machines that I have no easy way of doing anything
to.

#2) http://esupport.ca.com/public/antivirus/infodocs/etrustav-xpsp2alert.asp
is the link., but you will probably need an account. Here is what the
link shows

Windows XP SP2 introduced a Windows Firewall component. By default the
firewall is set to block ports that eTrust Antivirus needs. We would
recommend to perform the following:

For eAV 6.0, 7.0 and 7.1 installations, please run the
AVEnablePorts.exe utility. The utility can be downloaded from
ftp://ftp.ca.com/pub/inoculan/AVEnablePorts.exe.

Windows XP SP2 also removed the Anonymous Access in the Remote
Procedure Call (RPC).

For eAV 7.1 installation, this is not affected.

For eAV 6.0 installation, please apply fix QO58103.

For eAV 7.0 installation, please apply fix QO58101.

Please contact your CA Technical Support for additional assistance.

----------
Again, the problem is that I don't have the ability to do anything on
these machines. They are all over the place.

That Microsoft link helps, but I am already provisioning to handle
this issue. We will be having the folks send these laptops in for
patching. My complaint is that there are a ton of other eTrust AV
users, and many of them will probably not be watching this SP2 issue
as seriously as they should. Past experience shows that these folks
will end up with SP2, but AV updates will quit working.

I applaud Microsofts' bold steps with XP SP2, I just wish that the
eSafe Antivirus updates would have been handled better by SP2. Like I
said, ZoneAlarm and Sygate handle it from the get-go correctly.

Edwin Davidson

Relevant Pages