cancel
Showing results for 
Search instead for 
Did you mean: 

Virus Scan 8.7i Disabled

I have installed McAfee VSE 8.7i on a few machines, and in all instance 8.7i is being disabled.

I am running ePO 3.6.1 with agent version 3.6.0.546, do I need to be running a newer agent version for this to work correctly.

I have installed the NAP for 8.7i, which makes sure that VSE is enabled. When I enforce policies, VSE enables itself for about 5 secs and then disables itself once more.

Can anyone help???
68 Replies
Massi79
Level 7
Report Inappropriate Content
Message 2 of 69

RE: Virus Scan 8.7i Disabled

did you install it OVER VSE 8.5 without uninstalling it first?
If this is the case, bad idea Smiley Happy
otherwise i cannot help you sad

RE: Virus Scan 8.7i Disabled

It was installed over the top...

Would you suggest completly uninstalling 8.7i and re-installing?

RE: Virus Scan 8.7i Disabled

I removed VSE 8.7i completly, restarted, reinstalled, restarted, problem still persists
Massi79
Level 7
Report Inappropriate Content
Message 5 of 69

RE: Virus Scan 8.7i Disabled

very strange
what kind of error do you get if you try starting mcshield service manually?

RE: Virus Scan 8.7i Disabled

I dont get any error messages, I am able to enable the service, it starts ok, and 5-15 secs later its disabled without any messages
Massi79
Level 7
Report Inappropriate Content
Message 7 of 69

RE: Virus Scan 8.7i Disabled

even in the event viewer?
impossible Smiley Happy
i bet it will say something like "5011" happy

RE: Virus Scan 8.7i Disabled

RE: Virus Scan 8.7i Disabled

Had these in the Eventviewer

Event ID 5000

 

McShield service started.
Engine version : 5300.2777
DAT version : 5399.0000

Number of signatures in EXTRA.DAT : None
Names of threats that EXTRA.DAT can detect : None



Followed by:

Event ID 5004

 

Could not contact Filter Driver.
Error = 0x7d1 : The specified driver is invalid.

RE: Virus Scan 8.7i Disabled

We are seeing this issue on our test machines as well, using our current production image and attempting an upgrade from 8.5i patch 6.1. Installed 8.7i and it is fine until the required reboot. On initialization, Access Pro. , Buffer overflow and On Access shut down. Cannot restart service from the MMC. I get the same message as above when attempting to start service. In our logs I get indication that there are not sufficient rights to start the service or modify it. I am logged into the local machine administrator account. Takes approximagtely 2 to 3 uninstall and reinstalls to get it working. Not an evolution I would want to try and coordinate with over 3000 systems and trying to deploy with ePO. Removal and reinstall of 8.5 SP6.1 works fine.