cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted
Level 7
Report Inappropriate Content
Message 1 of 11

McShield service terminated unexpectedly.

hi

We have MSE 8.7i SP2 installed.

Every time during the Update I can see in Event Logs these Errors on our servers:

Event Type:    Error

Event Source:    McLogEvent
Event Category:    None
Event ID:    1008
Date:        24.04.2010
Time:        01:16:22
User:        N/A
Computer:    SRV
Description:
The McShield service terminated unexpectedly.
Please review event 5019 or 5051 for details. The McShield service will be restarted in 5 seconds;

Howto solve this problem?


on 5/8/10 5:37:00 PM CDT
10 Replies
Highlighted
Level 7
Report Inappropriate Content
Message 2 of 11

Re: McShield service terminated unexpectedly.

Still cannot find any solution for this problem.

Highlighted
Level 12
Report Inappropriate Content
Message 3 of 11

Re: McShield service terminated unexpectedly.

The obvious first course of action is to apply VSE 8.7i Patch 3 and see if this fixes the problem.

Highlighted
Level 7
Report Inappropriate Content
Message 4 of 11

Re: McShield service terminated unexpectedly.

Thx, I will try to install VSE 8.7i Patch 3.

Highlighted
Level 7
Report Inappropriate Content
Message 5 of 11

Re: McShield service terminated unexpectedly.

I´m also having this issue.

The system was upgraded from Agent 4.0.0.1494 and VSE 8.5.0 Path 8 to an Agent 4.0.0.1494 and VSE 8.7.0 Patch 3.

The problem persists. In the Event Log i got 2 errors:

First:

A thread in process C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe took longer than 20000 ms to complete a request.

The process will be terminated. Thread id : 2532 (0x9e4)

Thread address : 0x7C90E514

Thread message :

Build VSCORE.14.1.0.524 / 5400.1158

Object being scanned = \Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\McAfee\Common Framework\DB\Agent_D-0163614.xml

by C:\Program Files\McAfee\Common Framework\FrameworkService.exe

4(500)(0)

4(500)(0)

7200(500)(0)

7595(500)(0)

7005(0)(0)

7004(0)(0)

5006(0)(0)

5004(0)(0)

=============================================================================0

Second:

The McShield service terminated unexpectedly.

Please review event 5019 or 5051 for details. The McShield service will be restarted in 5 seconds;

==============================================================================

It looks like when the OAS does the scan on the "\Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\McAfee\Common Framework\DB\Agent_D-0163614.xml" it gives an error!

Thanks!

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 11

Re: McShield service terminated unexpectedly.

This issue will be resolved with Patch 4.

The cause has been found to be in how our scanners are utilizing a memory mapped file named MFERUNTIME.DAT.

Not everybody sees this problem, but technically everybody could. It's a timing issue between McShield.exe and EngineServer.exe, real-time scanner and out-of-proc scanner, respectively. Each tries to create the mferuntime.dat file post update, and only one can succeed, causing the second to enter a retry loop that can exhibit a number of symptoms - performance loss and timeouts being most common.

Unfortunately we cannot hotfix this problem. The code changes involved are too extensive, and requires the testing afforded in a Patch cycle.

It is believed that this issue alone will be the key reason our customer base adopts patch 4. Patch 4 is scheduled for general availability end of July.

I hope knowing the solution is coming helps to bare the existence of the issuse until that time.

There is an extreme workaround.

The issue exists as a race condition between McShield and EngineServer, therefore you break the condition by removing either of those services. You cannot do without McShield, but you might be able to do without EngineServer. It's a risky change, and not one we can support or condone - it would have to be reverted prior to Patch 4 being applied, and is painful to try and implement or manage. Therefore, it would be better to bare with the post update annoyance until Patch 4 is available.

William W. Warren | S.I.R.R. | Customer Success Group | McAfee
Highlighted
Level 10
Report Inappropriate Content
Message 7 of 11

Re: McShield service terminated unexpectedly.

We have many of them reported daily on low spec PCs.

That's the main reason we stopped upgrade to vse8.7.

We're waiting for patch 4.

Highlighted
Level 7
Report Inappropriate Content
Message 8 of 11

Re: McShield service terminated unexpectedly.

We also expiernce this in our environment, with about 65000 clients this is quite an issue.

our McAfee SAM told me that the patch 4 RTW has been changed to end of next month...

Highlighted
Level 7
Report Inappropriate Content
Message 9 of 11

Re: McShield service terminated unexpectedly.

Has the problem been solved with 8.7 patch 4?

Highlighted
Level 7
Report Inappropriate Content
Message 10 of 11

Re: McShield service terminated unexpectedly.

Hi,

     I experiencing the same problem, however I am running Agent 4.5.0.1810 and VSE 8.7 SP5.

The McShield service terminated unexpectedly.

Please review event 5019 or 5051 for details. The McShield service will be restarted in 50 seconds;

        Any idea to resolve this issue, thanks.      

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community