How to troubleshoot a failure to detect the EICAR malware test file in MOVE Antivirus Agentless

Technical Articles ID: KB89358
Last Modified: 2023-03-24 19:38:47 Etc/GMT

Environment

Management for Optimized Virtual Environments (MOVE)
MOVE AntiVirus Agentless (MOVE AV Agentless) 4.x
MOVE Security Virtual Machine (SVM)

Summary

Most serious failures that occur in the MOVE AV Agentless system result in a failure to detect the EICAR malware test file. These failures can be framed as an EICAR detection failure issue.

The following procedure explains how to troubleshoot a failure to detect the EICAR test file by verifying the configuration of the entire system.

Correct any conflicts between the current configuration on the system that failed and the configuration listed in this article. When you are finished, retest the system.

Problem

A system that MOVE AV Agentless must protect allows you to copy, open, save, or download the EICAR test file.

Solution

Verify the following settings:

In the On Access Scan (OAS) Policy:
1. Enable OAS.
2. Enable scan when writing to disk.
3. Enable scan when reading from disk.
4. Verify that there are no exclusions for the file type, name, or location present.
5. Make sure File Types to Scan is either All files or includes the file type.
In Security Virtual Machine (SVM) Settings Policy, click test connect. If it fails, audit the SVM connection information and credentials.
At the endpoint, check for the vsepflt filter driver:
1. Open an elevated command prompt.
2. Run the command sc query vsepflt. It must display that the file is present on the endpoint and is in a running state.
  
  NOTE: There must be one instance of the driver loaded per volume on the endpoint.
3. If the query shows that the filter loaded but the EICAR file is still not detected, unload and reload the driver by running the command fltmc unload vsepflt followed by fltmc load vsepflt.
4. If the query fails to find the driver, look for vsepflt.sys in c:\windows\system32\drivers.
5. If the file is present, go back to the command prompt and run the command fltmc load vsepflt.
6. If the driver loads, but EICAR file is still not detected, verify the vsepflt.sys is the latest version. It is a VMware owned driver. The drive is updated through the VMware Tools package. It is deployed to every guest in a VMware environment. Load the updated driver and test.
Review the following KB articles:
- KB88103 - EICAR detection fails in My Documents and in desktop folders
- KB89205 - EICAR test file is not removed from the client and appears to go undetected
Verify the VMware side of the installation as described in the MOVE installation guide

IMPORTANT: If the above checks are confirmed good, the system must be investigated for a fault condition. Collect a MER from each SVM that isn't detecting the EICAR test file, and contact Technical Support. See KB80097 - How to generate the MOVE AntiVirus Agentless MER file.

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.

If you are a registered user, type your User ID and Password, and then click Log In.
If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

How to troubleshoot a failure to detect the EICAR malware test file in MOVE Antivirus Agentless

Environment

Summary

Problem

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

How to troubleshoot a failure to detect the EICAR malware test file in MOVE Antivirus Agentless

Environment

Summary

Problem

Solution

Affected Products

Languages:

Choose your region

Title

Title