Mctray.exe error after install of latest agent 4.8.0.887

[tonyharding]

Hi

We have rolled out company wide the latest ePO agent 4.8.0.887.

We are now getting the following the error on numerous Windows 7 clients....

McTray.exe - Application Error

The Instruction at 0x7598fb63 referenced memory at 0x01e9b458.The memory cound not be read.

Click on OK to terminate the program.

Has anyone else seen this or logged a call with Mcafee support about this error ?

Many thanks

Tony

[rackroyd]

Just checking, do you have an open call with McAfee support for this already ?

[tonyharding]

Hi

Yes I have opened a support call for the issue. I have produced the mer logs and now awaiting to hear back from Mcafee.

Thanks

Tony

[jstanley]

Point products have code running in the mctray memory space so it is possible that to see the issue you must have some version or another of a point product installed. Try uninstalling point products from the affected client one at a time, rebooting betwen each one and see if the issue persists. If you remove a point product and the issue goes away then put that product back on the machine and reboot and see if the issue comes back. If it does then I would recommend as a first step applying whatever the latest patch is for that  product.

[chrisneil]

Did you get an answer to this? I am having the same problem.

I'm following jstanley's advice currently and looking at each point product in turn - VSE88, HIP8, DLP93.

Thanks,

Chris

[tonyharding]

hiya - yes i did - i had to deploy the latest patch and hotfix for HIPs to resolve the issue.

Good luck

Tony

[ssadlocha]

I have been seeing McTray.exe errors quite a bit lately. In all of my cases, they are related to the EEPC agent dll. I have tried installing the ePO agent, as well as EEPC components. The only thing I have found to work is removing EEPC and EEPC agent, followed by a reboot, then installing again. Unfortunately, this can only be done by decrypting the drive and deactivating it, so it is a time consuming process, and a real pain.

[ssadlocha]

Well, a little update on this. I have been working to clear this error in my environment by decrypting and deactivating drives, removing EEPC, rebooting, removing EEPC Agent, rebooting, and then running the whole install and encrypt process all over again. For quite a few this has worked, but for a couple folks, the error came back after a couple days. This is a real time-consuming pain for me, and I need to figure out what I can do to remedy it.

[chrisneil]

Sorry, meant to post for a while now.

We investigated all of our point products, but they were all up-to-date with no scope for upgrading/patching.

The solution we found was around the tray icons. We were still using legacy settings in our policy. The only icon visible to our users was the VirusScan shield. When we switched to displaying the Agent icon the problem went away.

[ssadlocha]

Your comments about the tray icon visibility are interesting. We have the agent tray icon set to Not Visible, and it seems that McAfee themselves recommends having this turned on, so I am guessing not many environments have it set this way. I would prefer it that way myself, but the call was made to hide visibility and I am working around it.

I have set up a test Agent General policy, and I have assigned the problematic laptops to it, with the shield icon visible. I have asked the users to monitor across the next several reboots and let me know if the issue persists.

I will post some results info as soon as I have anything. Also, I noticed that, just for laptops, we have the "Run agent processes at lower CPU priority (Windows only)" enabled, and the issue has only been seen on laptops, so this may be another setting I might look into later. My thoughts with that are that, since we only see the issue at bootup, the Agent is trying to run a policy enforcement, is using up too many resources, and attempts to throttle itself but crashes instead. Maybe a stretch, but it came to mind.