McShield service terminated unexpectedly

[rcarles]

We have the same issue as Josh Donohue but it seems can come from a different point as I'm seeing now the GLobal Updating setting in ePO has always been disabled. I will try now to add those processes he says to the low risk process list and see if that helps.

[UNVNettech]

Update:

We're still experiencing this problem on our Windows 2000 Terminal Server....granted, it is happening less frequently but it's still happening.  I had to powercycle the server this morning after yet another 5051 scan time out:

A thread in process C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe took longer than 120000 ms to complete a request.
 The process will be terminated. Thread id : 3468 (0xd8c)
 Thread address : 0x77F88403
 Thread message : 
 Build VSCORE.14.1.0.515 / 5400.1158
 Object being scanned = \Device\HarddiskVolume1\Documents and Settings\xxxxx\Application Data\Microsoft\Office\MSOut11.pip
 by System

We've been working with support and have exhausted the work-arounds in the knowledgebase document I referenced in my original post.  Global Updating has never been enabled in our environment since the initial deployment of the product, several versions past.

[RickIA]

Well we just experienced another round of this machine lock down today. I have a client task that sends out to the desktop agents to update DAT's and engines for VSE 8.7i (we have patch 2 and the hotfix installed) and IMMEDIATELY after the DAT update, several machines just hung. Went into task manager and engerserver.exe was taking all of one core, but MASSIVE I/O writes. The machine was pretty much dead locked. This went on for 8-10 minutes. I also saw a machine yesterday with engineserver.exe that was using over 1GB of pagefile. What is going on with engineserver.exe???

[SteveTroup]

I've got one particular server that is getting this restart issue atleast once a day, its usually random files that cause the problem already reported in this thread.

In my particular case I've got an idea as to whats causing it, opportunistic locking. The particular server thats having issues is the only one that has oplocks enabled (all my other servers have it disabled) due to it acting as the storage location for Windows Vista and 7 pc's using offline files.

Obviously I can't disable oplocks as this breaks the Windows Vista and 7 offline files but it is becoming annoying when my taskbar freezes for 30-40 seconds and then reports that my network folders are no longer synchronised.

I don't suppose 8.7i can just test a file to see if its locked before attempting a scan and I've missed the option in EPO?

[mandybuzby]

We seem to be having the problem on our AMD machines on a daily basis, our Intel machines only have this issue about once per week.  Any idea what could be the problem?  We are still trying to find a solution.

[rmetzger]

mandybuzby wrote:
We seem to be having the problem on our AMD machines on a daily basis, our Intel machines only have this issue about once per week.  Any idea what could be the problem?  We are still trying to find a solution.

Hi Mandy,

Would you mind telling us what you have tried (from this Entire thread) and what you have not tried. Any details, log files, software versions, etc. help in understanding your specific issues.

I have not heard of issues that are specific to a particular brand of processor, and I see that it may be a coincidence that the AMD systems are seeing it more often than Intel. (In other words, other factors may be involved with models that happen to have AMD processors.)

Thanks,

Ron Metzger

[mgx]

bump, experiencing this too

[SteveTroup]

I've been checking my other servers and a few more an experiencing issues with scan time outs this usually preceeds the service termination on the server I mentioned in my prior posts but instead just cancel the scan and carry on.

Because of this I went digging and found that it was happening directly after or during the period assigned for the scheduled client update. So I changed the timing of my entire epo system, the scheduled client update happens much later after the server update task, they now only report back every 20 minutes instead of the default 5 and I also set the random element to an 45 minutes instead of the 30 I had previously. I also made sure the 'Processes on enable' is in the default state of off.

Still getting the same problem.

[kamikaze_fish]

I don't have much to contribute but I wanted everyone to know you're not alone.  I'm having the same issues with several XP machines.

[SteveTroup]

From this response in another thread http://community.mcafee.com/message/133545#133545

it looks like we're all waiting for patch 4 due at the end of this month.

Message was edited by: SteveTroup on 02/07/10 05:52:13 CDT