cancel
Showing results for 
Search instead for 
Did you mean: 
flo84
Level 8
Report Inappropriate Content
Message 1 of 5

IIS-Error after applying VirusScan 8.8 Patch 4

Jump to solution

Hi everyone,

after upgrading VirusScan 8.8 Patch 3 to 8.8 Patch 4 I'm discovering error messages in the application eventlog on all our IIS Servers (including WSUS). OS: Windows Server 2008 R2, all MS-patches are installed.

Error ID 1000, Source "Application Error", Message (translated from german into english):

Application: svchost.exe_WAS, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc3c1

Faulty modules: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000

Exceptioncode: 0xc0000005

Erroroffset: 0x00000000019bc6f7

ID of the faulty process: 0x6cd0

Start time of the faulty app: 0x01cfad5cac8e1fc2

Path of the faulty app: C:\Windows\system32\svchost.exe

Path of the faulty modules: unknown

A few seonds befor this error occurs there is an information message in the system eventlog, ID 5074, Source WAS:

A worker process with process id "58844" for application pool "WsusPool" has required a reuse because the worker process has reached it's processing time limit (in german: Ein Arbeitsprozess mit der Prozess-ID "58844" für den Anwendungspool "WsusPool" hat die Wiederverwendung angefordert, da der Arbeitsprozess das zulässige Verarbeitungszeitlimit erreicht hat.)

As I wrote: after this informational message the error occurs. The WWW-Publishing and Windows Process Activation service crashes and starts again, so the problem is not very critical, but I want to find a solution for this. We never got this error(s) before, they came up after deploying patch 4 for VirusScan 8.8. I already contacted the McAfee support - but without a solution yet (at the moment I'm waiting for an answer). Because we are getting this errors on all our W2k8R2 Servers that has IIS/WSUS installed on it I can't believ there is no one out there having the same problems/errors!? The McAfee support guy asked me to follow the McAfee Best Practice Guide to add the recommended exceptions/exclusions into the ePO policy - I did that but without success, the errors are still there.

Is anyone out there who is having the same problem and knows how to fix it? 🙂

Thanks! Florian

1 Solution

Accepted Solutions
flo84
Level 8
Report Inappropriate Content
Message 4 of 5

Re: IIS-Error after applying VirusScan 8.8 Patch 4

Jump to solution

Thank you for your answer. You are talking about this article, don't you? McAfee KnowledgeBase - VirusScan Enterprise 8.8 Patch 4 Known Issues

There is one IIS-problem in the list: ... Issue: The W3WP.exe process on web servers may exhibit high CPU after installing VSE 8.8 Patch 4. ...


The thing is: that's not really my problem 🙂 But I got an answer from McAfee Support and it seems that the hint the guy gave me fixed the problem. You have to modify your VirusScan 8.8 policy and add some exclusions for "On-Access Default Processes Policies", "On-Access Low-Risk Processes Policies" and "On-Access High-Risk Processes Policies":


**\System32\Inetsrv\

**\IIS Temporary Compressed Files\

**\MNS_FSW_DIR*\

And I added w3wp.exe in "On-Access Low-Risk Processes Policies" as a "Low Risk Process" + uncheck the checkboxes "When writing to disk" and  "When reading from disk" (but ONLY for Low-Risk Processes!!!).  I made this changes yesterday - no errors since that time. But as I mentioned in my prevoius post it happens spontaneously that the IIS service crashes...So I'll wait 2 more days and let you know if the problem is definitely fixed.


PS: have a look at the VirusScan 8.8 Best Practice Guide for more details: https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/22000/PD22940/en_US/...


4 Replies

Re: IIS-Error after applying VirusScan 8.8 Patch 4

Jump to solution

Hi there,

I'm also facing this problem.

Had patch the server on 10th May(after upgrading VirusScan 8.8 Patch 3 to 8.8 Patch 4) and starting from 11th May the issue started.

Almost 1-2 time a week the error will cause the Win2008R2 IIS AppPool to go down 20times now since 10th May and in 2 recent case it do not automatically recover with IISreset or AppPool recycle. Had to manually create a new AppPool to bring up the site.

No problems before this patch was applied and also latest on MS patches as of 27 April.

Hope to get a resolution for this issue.

Thanks and Regards,

Masrizal

Highlighted
pato
Level 7
Report Inappropriate Content
Message 3 of 5

Re: IIS-Error after applying VirusScan 8.8 Patch 4

Jump to solution

Have you read the release notes of patch 4? I'm fairly sure there was a known issue mentioned with IIS and maybe .Net applications (or only IIS).

flo84
Level 8
Report Inappropriate Content
Message 4 of 5

Re: IIS-Error after applying VirusScan 8.8 Patch 4

Jump to solution

Thank you for your answer. You are talking about this article, don't you? McAfee KnowledgeBase - VirusScan Enterprise 8.8 Patch 4 Known Issues

There is one IIS-problem in the list: ... Issue: The W3WP.exe process on web servers may exhibit high CPU after installing VSE 8.8 Patch 4. ...


The thing is: that's not really my problem 🙂 But I got an answer from McAfee Support and it seems that the hint the guy gave me fixed the problem. You have to modify your VirusScan 8.8 policy and add some exclusions for "On-Access Default Processes Policies", "On-Access Low-Risk Processes Policies" and "On-Access High-Risk Processes Policies":


**\System32\Inetsrv\

**\IIS Temporary Compressed Files\

**\MNS_FSW_DIR*\

And I added w3wp.exe in "On-Access Low-Risk Processes Policies" as a "Low Risk Process" + uncheck the checkboxes "When writing to disk" and  "When reading from disk" (but ONLY for Low-Risk Processes!!!).  I made this changes yesterday - no errors since that time. But as I mentioned in my prevoius post it happens spontaneously that the IIS service crashes...So I'll wait 2 more days and let you know if the problem is definitely fixed.


PS: have a look at the VirusScan 8.8 Best Practice Guide for more details: https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/22000/PD22940/en_US/...


flo84
Level 8
Report Inappropriate Content
Message 5 of 5

Re: IIS-Error after applying VirusScan 8.8 Patch 4

Jump to solution

OK - the problem was solved by adding the exlusions I mentioned in my previous post. Case closed 🙂

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community