1 2 Previous Next 10 Replies Latest reply on Sep 9, 2011 1:02 PM by wwarren

    McShield service terminated unexpectedly.

      hi

       

      We have MSE 8.7i SP2 installed.

       

      Every time during the Update I can see in Event Logs these Errors on our servers:

       

      Event Type:    Error

      Event Source:    McLogEvent
      Event Category:    None
      Event ID:    1008
      Date:        24.04.2010
      Time:        01:16:22
      User:        N/A
      Computer:    SRV
      Description:
      The McShield service terminated unexpectedly.
      Please review event 5019 or 5051 for details. The McShield service will be restarted in 5 seconds;

       

      Howto solve this problem?


       

       

      on 5/8/10 5:37:00 PM CDT
        • 1. Re: McShield service terminated unexpectedly.

          Still cannot find any solution for this problem.

          • 2. Re: McShield service terminated unexpectedly.
            PhilR

            The obvious first course of action is to apply VSE 8.7i Patch 3 and see if this fixes the problem.

            1 of 1 people found this helpful
            • 3. Re: McShield service terminated unexpectedly.

              Thx, I will try to install VSE 8.7i Patch 3.

              • 4. Re: McShield service terminated unexpectedly.
                jgpedro

                I´m also having this issue.

                 

                The system was upgraded from Agent 4.0.0.1494 and VSE 8.5.0 Path 8 to an Agent 4.0.0.1494 and VSE 8.7.0 Patch 3.

                 

                The problem persists. In the Event Log i got 2 errors:

                 

                First:

                 

                A thread in process C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe took longer than 20000 ms to complete a request.

                The process will be terminated. Thread id : 2532 (0x9e4)

                Thread address : 0x7C90E514

                Thread message :

                Build VSCORE.14.1.0.524 / 5400.1158

                Object being scanned = \Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\McAfee\Common Framework\DB\Agent_D-0163614.xml

                by C:\Program Files\McAfee\Common Framework\FrameworkService.exe

                4(500)(0)

                4(500)(0)

                7200(500)(0)

                7595(500)(0)

                7005(0)(0)

                7004(0)(0)

                5006(0)(0)

                5004(0)(0)

                =============================================================================0

                 

                Second:

                 

                The McShield service terminated unexpectedly.

                Please review event 5019 or 5051 for details. The McShield service will be restarted in 5 seconds;

                 

                ==============================================================================

                 

                It looks like when the OAS does the scan on the "\Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\McAfee\Common Framework\DB\Agent_D-0163614.xml" it gives an error!

                 

                Thanks!

                 

                 

                • 5. Re: McShield service terminated unexpectedly.
                  wwarren

                  This issue will be resolved with Patch 4.

                  The cause has been found to be in how our scanners are utilizing a memory mapped file named MFERUNTIME.DAT.

                   

                  Not everybody sees this problem, but technically everybody could. It's a timing issue between McShield.exe and EngineServer.exe, real-time scanner and out-of-proc scanner, respectively. Each tries to create the mferuntime.dat file post update, and only one can succeed, causing the second to enter a retry loop that can exhibit a number of symptoms - performance loss and timeouts being most common.

                   

                  Unfortunately we cannot hotfix this problem. The code changes involved are too extensive, and requires the testing afforded in a Patch cycle.

                  It is believed that this issue alone will be the key reason our customer base adopts patch 4. Patch 4 is scheduled for general availability end of July.

                  I hope knowing the solution is coming helps to bare the existence of the issuse until that time.

                   

                  There is an extreme workaround.

                  The issue exists as a race condition between McShield and EngineServer, therefore you break the condition by removing either of those services. You cannot do without McShield, but you might be able to do without EngineServer. It's a risky change, and not one we can support or condone - it would have to be reverted prior to Patch 4 being applied, and is painful to try and implement or manage. Therefore, it would be better to bare with the post update annoyance until Patch 4 is available.

                  • 6. Re: McShield service terminated unexpectedly.
                    psolinski

                    We have many of them reported daily on low spec PCs.

                     

                    That's the main reason we stopped upgrade to vse8.7.

                     

                    We're waiting for patch 4.

                    • 7. Re: McShield service terminated unexpectedly.

                      We also expiernce this in our environment, with about 65000 clients this is quite an issue.

                       

                      our McAfee SAM told me that the patch 4 RTW has been changed to end of next month...

                      • 8. Re: McShield service terminated unexpectedly.

                        Has the problem been solved with 8.7 patch 4?

                        • 9. Re: McShield service terminated unexpectedly.

                          Hi,

                           

                               I experiencing the same problem, however I am running Agent 4.5.0.1810 and VSE 8.7 SP5.

                           

                          The McShield service terminated unexpectedly.

                          Please review event 5019 or 5051 for details. The McShield service will be restarted in 50 seconds;

                           

                                  Any idea to resolve this issue, thanks.      

                          1 2 Previous Next