cancel
Showing results for 
Search instead for 
Did you mean: 
mcdave
Level 10
Report Inappropriate Content
Message 1 of 2

Management agent problems

Hi

On my PC (Win7 64bit) has the following strange behaviour.
In the VirusScan Console the "Access Protection" & "Buffer Overflow Protection" tasks are disabled.
I can access the agent log once vie http "http://<client-IP>:8092/" but when I refresh the FrameworkAgent stops?

I'm using:

  • Agent 4.5.0.1499
  • VSE 8.7i + Patch 2

Here are some event logs:

Header 1
Log Name:      Application
Source:        Windows Error Reporting
Date:          10/09/2010 9:50:11
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      myPC.xx.xx
Description:
Fault bucket 9, type 1
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: FrameworkService.exe
P2: 4.5.0.1499
P3: 4bcfaeb5
P4: ListenServer.dll
P5: 4.5.0.1499
P6: 4bcfb083
P7: c0000005
P8: 0000f350
P9:
P10:

Attached files:
C:\Windows\Temp\WER19D2.tmp.appcompat.txt
C:\Windows\Temp\WER532B.tmp.WERInternalMetadata.xml
C:\Windows\Temp\WER536A.tmp.hdmp
C:\Windows\Temp\WER5B76.tmp.mdmp

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_FrameworkService_1f0b9b24abdad98a4a6afa022a2429637467b9_00406c26

Analysis symbol:
Rechecking for solution: 0
Report Id: fcbd68e1-bcaf-11df-84fe-005056c00008
Report Status: 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2010-09-10T07:50:11.000000000Z" />
    <EventRecordID>18510</EventRecordID>
    <Channel>Application</Channel>
    <Computer>myPC.xx.xx</Computer>
    <Security />
  </System>
  <EventData>
    <Data>9</Data>
    <Data>1</Data>
    <Data>APPCRASH</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>FrameworkService.exe</Data>
    <Data>4.5.0.1499</Data>
    <Data>4bcfaeb5</Data>
    <Data>ListenServer.dll</Data>
    <Data>4.5.0.1499</Data>
    <Data>4bcfb083</Data>
    <Data>c0000005</Data>
    <Data>0000f350</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
C:\Windows\Temp\WER19D2.tmp.appcompat.txt
C:\Windows\Temp\WER532B.tmp.WERInternalMetadata.xml
C:\Windows\Temp\WER536A.tmp.hdmp
C:\Windows\Temp\WER5B76.tmp.mdmp</Data>
    <Data>C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_FrameworkService_1f0b9b24abdad98a4a6afa022a2429637467b9_00406c26</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>fcbd68e1-bcaf-11df-84fe-005056c00008</Data>
    <Data>0</Data>
  </EventData>
</Event>
Log Name:      Application
Source:        Windows Error Reporting
Date:          10/09/2010 9:50:08
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      myPC.xx.xx
Description:
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: FrameworkService.exe
P2: 4.5.0.1499
P3: 4bcfaeb5
P4: ListenServer.dll
P5: 4.5.0.1499
P6: 4bcfb083
P7: c0000005
P8: 0000f350
P9:
P10:

Attached files:
C:\Windows\Temp\WER19D2.tmp.appcompat.txt
C:\Windows\Temp\WER532B.tmp.WERInternalMetadata.xml
C:\Windows\Temp\WER536A.tmp.hdmp
C:\Windows\Temp\WER5B76.tmp.mdmp

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_FrameworkService_1f0b9b24abdad98a4a6afa022a2429637467b9_cab_16fc5dd4

Analysis symbol:
Rechecking for solution: 0
Report Id: fcbd68e1-bcaf-11df-84fe-005056c00008
Report Status: 4
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2010-09-10T07:50:08.000000000Z" />
    <EventRecordID>18509</EventRecordID>
    <Channel>Application</Channel>
    <Computer>myPC.xx.xx</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>APPCRASH</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>FrameworkService.exe</Data>
    <Data>4.5.0.1499</Data>
    <Data>4bcfaeb5</Data>
    <Data>ListenServer.dll</Data>
    <Data>4.5.0.1499</Data>
    <Data>4bcfb083</Data>
    <Data>c0000005</Data>
    <Data>0000f350</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
C:\Windows\Temp\WER19D2.tmp.appcompat.txt
C:\Windows\Temp\WER532B.tmp.WERInternalMetadata.xml
C:\Windows\Temp\WER536A.tmp.hdmp
C:\Windows\Temp\WER5B76.tmp.mdmp</Data>
    <Data>C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_FrameworkService_1f0b9b24abdad98a4a6afa022a2429637467b9_cab_16fc5dd4</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>fcbd68e1-bcaf-11df-84fe-005056c00008</Data>
    <Data>4</Data>
  </EventData>
</Event>
Log Name:      Application
Source:        Application Error
Date:          10/09/2010 9:49:49
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      myPC.xx.xx
Description:
Faulting application name: FrameworkService.exe, version: 4.5.0.1499, time stamp: 0x4bcfaeb5
Faulting module name: ListenServer.dll, version: 4.5.0.1499, time stamp: 0x4bcfb083
Exception code: 0xc0000005
Fault offset: 0x0000f350
Faulting process id: 0xbec
Faulting application start time: 0x01cb50bc05cc37a1
Faulting application path: C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
Faulting module path: C:\Program Files (x86)\McAfee\Common Framework\ListenServer.dll
Report Id: fcbd68e1-bcaf-11df-84fe-005056c00008
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2010-09-10T07:49:49.000000000Z" />
    <EventRecordID>18508</EventRecordID>
    <Channel>Application</Channel>
    <Computer>myPC.xx.xx</Computer>
    <Security />
  </System>
  <EventData>
    <Data>FrameworkService.exe</Data>
    <Data>4.5.0.1499</Data>
    <Data>4bcfaeb5</Data>
    <Data>ListenServer.dll</Data>
    <Data>4.5.0.1499</Data>
    <Data>4bcfb083</Data>
    <Data>c0000005</Data>
    <Data>0000f350</Data>
    <Data>bec</Data>
    <Data>01cb50bc05cc37a1</Data>
    <Data>C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe</Data>
    <Data>C:\Program Files (x86)\McAfee\Common Framework\ListenServer.dll</Data>
    <Data>fcbd68e1-bcaf-11df-84fe-005056c00008</Data>
  </EventData>
</Event>

I'll try installing VSE8.7i Patch 3 later today.

regards
Dave

Message was edited by: mcdave on 10/09/10 04:37:18 CDT
1 Reply
mcdave
Level 10
Report Inappropriate Content
Message 2 of 2

Re: Management agent problems

Installed VSE 8.7i Patch 3.

But the issues remains

I also can't unlock the password protected virusscan console (wrong password message) while I'm 200% sure it's correct one.
This is  probably a side effect I presume?

But when I check the eposerver the client does get synced, he virusdef files still getting updated (client task distributes from eposerver)?

UPDATE: reinstalling Management Agent didn't help as well

Message was edited by: mcdave on 10/09/10 04:42:18 CDT