To detect, clean, and prevent subsequent infections, perform a recovery and update your anti-virus software:
- Perform a DETech emergency boot with a 30 minute or longer wait. This pause allows synchronization to occur with the ePolicy Orchestrator (ePO) server, which rebuilds the preboot File System (PBFS) and restores the DE Master Boot Record (MBR):
Related details regarding the delay in rebuilding the PBFS
- The 30 minutes mentioned above is an estimate based on event upload and agent-server communications interval (ASCI) settings for the McAfee Agent.
The first change occurs after an initial policy enforcement on the client, which triggers events to be uploaded to ePO. The result is that the PBFS information is provided and then pushed down to the client via Event updates.
- The time required for the PBFS rebuild depends on several factors, such as Policy enforcement, ASCI, and DC load on the ePO server and Agent Handler to succeed.
If the emergency boot fails, you must remove and reinstall DE.
NOTE: The Restore DE MBR option isn't present on a DETech recovery media because the MBR is restored during an emergency boot.
- To detect and prevent subsequent MBR infections, update your anti-virus software.