All other antivirus products must be removed from the virtual machine while the McAfee AV Client is running.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-42933	AV-MOVE-CLT-001	SV-55662r1_rule		Medium

Description
Organizations should deploy antivirus software on all hosts for which satisfactory antivirus software is available. Antivirus software should be installed as soon after OS installation as possible and then updated with the latest signatures and antivirus software patches (to eliminate any known vulnerabilities in the antivirus software itself). To support the security of the host, the antivirus software should be configured and maintained properly so it continues to be effective at detecting and stopping malware. Antivirus software is most effective when its signatures are fully up-to-date. Accordingly, antivirus software should be kept current with the latest signature and software updates to improve malware detection. McAfee MOVE AV Client will not function properly with other antivirus products installed.

Description

Organizations should deploy antivirus software on all hosts for which satisfactory antivirus software is available. Antivirus software should be installed as soon after OS installation as possible and then updated with the latest signatures and antivirus software patches (to eliminate any known vulnerabilities in the antivirus software itself). To support the security of the host, the antivirus software should be configured and maintained properly so it continues to be effective at detecting and stopping malware. Antivirus software is most effective when its signatures are fully up-to-date. Accordingly, antivirus software should be kept current with the latest signature and software updates to improve malware detection. McAfee MOVE AV Client will not function properly with other antivirus products installed.

STIG	Date
McAfee MOVE 2.6 Multi-Platform Client STIG	2014-01-15

Details

Check Text ( C-49122r1_chk )
Access the system to which McAfee MOVE Client is installed. In the taskbar, right-click the red McAfee Agent shield and select "About". Ensure neither the "McAfee VirusScan Enterprise + AntiSpyware Enterprise" nor the "Symantec Plugin" is listed as an installed product. Access services.msc and review the services running on the system. Ensure no other antivirus products are installed. If either the "McAfee VirusScan Enterprise + AntiSpyware Enterprise" or the "Symantec Plugin" is listed as an installed product in the McAfee Agent "About" dialog box, this is a finding. If neither the "McAfee VirusScan Enterprise + AntiSpyware Enterprise" or the "Symantec Plugin" is listed as an installed product, but another antivirus product is shown as running as a service on this system, this is a finding.

Check Text ( C-49122r1_chk )

Access the system to which McAfee MOVE Client is installed. In the taskbar, right-click the red McAfee Agent shield and select "About".
Ensure neither the "McAfee VirusScan Enterprise + AntiSpyware Enterprise" nor the "Symantec Plugin" is listed as an installed product.

Access services.msc and review the services running on the system.
Ensure no other antivirus products are installed.

If either the "McAfee VirusScan Enterprise + AntiSpyware Enterprise" or the "Symantec Plugin" is listed as an installed product in the McAfee Agent "About" dialog box, this is a finding.
If neither the "McAfee VirusScan Enterprise + AntiSpyware Enterprise" or the "Symantec Plugin" is listed as an installed product, but another antivirus product is shown as running as a service on this system, this is a finding.

Fix Text (F-48515r1_fix)
Click on "Start"->"Control Panel". Choose the "Uninstall a program" under the "Programs" section. Find the installed antivirus product, other than the McAfee MOVE AV Client, and choose to uninstall it.