cancel
Showing results for 
Search instead for 
Did you mean: 
cccc
Level 7
Report Inappropriate Content
Message 1 of 11

McShield service terminated unexpectedly.

hi

We have MSE 8.7i SP2 installed.

Every time during the Update I can see in Event Logs these Errors on our servers:

Event Type:    Error

Event Source:    McLogEvent
Event Category:    None
Event ID:    1008
Date:        24.04.2010
Time:        01:16:22
User:        N/A
Computer:    SRV
Description:
The McShield service terminated unexpectedly.
Please review event 5019 or 5051 for details. The McShield service will be restarted in 5 seconds;

Howto solve this problem?


on 5/8/10 5:37:00 PM CDT
10 Replies
cccc
Level 7
Report Inappropriate Content
Message 2 of 11

Re: McShield service terminated unexpectedly.

Still cannot find any solution for this problem.

PhilR
Level 12
Report Inappropriate Content
Message 3 of 11

Re: McShield service terminated unexpectedly.

The obvious first course of action is to apply VSE 8.7i Patch 3 and see if this fixes the problem.

cccc
Level 7
Report Inappropriate Content
Message 4 of 11

Re: McShield service terminated unexpectedly.

Thx, I will try to install VSE 8.7i Patch 3.

jgpedro
Level 7
Report Inappropriate Content
Message 5 of 11

Re: McShield service terminated unexpectedly.

I´m also having this issue.

The system was upgraded from Agent 4.0.0.1494 and VSE 8.5.0 Path 8 to an Agent 4.0.0.1494 and VSE 8.7.0 Patch 3.

The problem persists. In the Event Log i got 2 errors:

First:

A thread in process C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe took longer than 20000 ms to complete a request.

The process will be terminated. Thread id : 2532 (0x9e4)

Thread address : 0x7C90E514

Thread message :

Build VSCORE.14.1.0.524 / 5400.1158

Object being scanned = \Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\McAfee\Common Framework\DB\Agent_D-0163614.xml

by C:\Program Files\McAfee\Common Framework\FrameworkService.exe

4(500)(0)

4(500)(0)

7200(500)(0)

7595(500)(0)

7005(0)(0)

7004(0)(0)

5006(0)(0)

5004(0)(0)

=============================================================================0

Second:

The McShield service terminated unexpectedly.

Please review event 5019 or 5051 for details. The McShield service will be restarted in 5 seconds;

==============================================================================

It looks like when the OAS does the scan on the "\Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\McAfee\Common Framework\DB\Agent_D-0163614.xml" it gives an error!

Thanks!

McAfee Employee wwarren
McAfee Employee
Report Inappropriate Content
Message 6 of 11

Re: McShield service terminated unexpectedly.

This issue will be resolved with Patch 4.

The cause has been found to be in how our scanners are utilizing a memory mapped file named MFERUNTIME.DAT.

Not everybody sees this problem, but technically everybody could. It's a timing issue between McShield.exe and EngineServer.exe, real-time scanner and out-of-proc scanner, respectively. Each tries to create the mferuntime.dat file post update, and only one can succeed, causing the second to enter a retry loop that can exhibit a number of symptoms - performance loss and timeouts being most common.

Unfortunately we cannot hotfix this problem. The code changes involved are too extensive, and requires the testing afforded in a Patch cycle.

It is believed that this issue alone will be the key reason our customer base adopts patch 4. Patch 4 is scheduled for general availability end of July.

I hope knowing the solution is coming helps to bare the existence of the issuse until that time.

There is an extreme workaround.

The issue exists as a race condition between McShield and EngineServer, therefore you break the condition by removing either of those services. You cannot do without McShield, but you might be able to do without EngineServer. It's a risky change, and not one we can support or condone - it would have to be reverted prior to Patch 4 being applied, and is painful to try and implement or manage. Therefore, it would be better to bare with the post update annoyance until Patch 4 is available.

William W. Warren | S.I.R.R. | Customer Success Group | McAfee
psolinski
Level 10
Report Inappropriate Content
Message 7 of 11

Re: McShield service terminated unexpectedly.

We have many of them reported daily on low spec PCs.

That's the main reason we stopped upgrade to vse8.7.

We're waiting for patch 4.

Bubba
Level 7
Report Inappropriate Content
Message 8 of 11

Re: McShield service terminated unexpectedly.

We also expiernce this in our environment, with about 65000 clients this is quite an issue.

our McAfee SAM told me that the patch 4 RTW has been changed to end of next month...

truge
Level 7
Report Inappropriate Content
Message 9 of 11

Re: McShield service terminated unexpectedly.

Has the problem been solved with 8.7 patch 4?

jlim42
Level 7
Report Inappropriate Content
Message 10 of 11

Re: McShield service terminated unexpectedly.

Hi,

     I experiencing the same problem, however I am running Agent 4.5.0.1810 and VSE 8.7 SP5.

The McShield service terminated unexpectedly.

Please review event 5019 or 5051 for details. The McShield service will be restarted in 50 seconds;

        Any idea to resolve this issue, thanks.      

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community