1 Reply Latest reply on Sep 10, 2010 4:42 AM by mcdave

    Management agent problems

    mcdave

      Hi

       

      On my PC (Win7 64bit) has the following strange behaviour.
      In the VirusScan Console the "Access Protection" & "Buffer Overflow Protection" tasks are disabled.
      I can access the agent log once vie http "http://<client-IP>:8092/" but when I refresh the FrameworkAgent stops?

       

      I'm using:

      • Agent 4.5.0.1499
      • VSE 8.7i + Patch 2

       

      Here are some event logs:

       

      Header 1
      Log Name:      Application
      Source:        Windows Error Reporting
      Date:          10/09/2010 9:50:11
      Event ID:      1001
      Task Category: None
      Level:         Information
      Keywords:      Classic
      User:          N/A
      Computer:      myPC.xx.xx
      Description:
      Fault bucket 9, type 1
      Event Name: APPCRASH
      Response: Not available
      Cab Id: 0

      Problem signature:
      P1: FrameworkService.exe
      P2: 4.5.0.1499
      P3: 4bcfaeb5
      P4: ListenServer.dll
      P5: 4.5.0.1499
      P6: 4bcfb083
      P7: c0000005
      P8: 0000f350
      P9:
      P10:

      Attached files:
      C:\Windows\Temp\WER19D2.tmp.appcompat.txt
      C:\Windows\Temp\WER532B.tmp.WERInternalMetadata.xml
      C:\Windows\Temp\WER536A.tmp.hdmp
      C:\Windows\Temp\WER5B76.tmp.mdmp

      These files may be available here:
      C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_FrameworkService_1f0 b9b24abdad98a4a6afa022a2429637467b9_00406c26

      Analysis symbol:
      Rechecking for solution: 0
      Report Id: fcbd68e1-bcaf-11df-84fe-005056c00008
      Report Status: 0
      Event Xml:
      <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
        <System>
          <Provider Name="Windows Error Reporting" />
          <EventID Qualifiers="0">1001</EventID>
          <Level>4</Level>
          <Task>0</Task>
          <Keywords>0x80000000000000</Keywords>
          <TimeCreated SystemTime="2010-09-10T07:50:11.000000000Z" />
          <EventRecordID>18510</EventRecordID>
          <Channel>Application</Channel>
          <Computer>myPC.xx.xx</Computer>
          <Security />
        </System>
        <EventData>
          <Data>9</Data>
          <Data>1</Data>
          <Data>APPCRASH</Data>
          <Data>Not available</Data>
          <Data>0</Data>
          <Data>FrameworkService.exe</Data>
          <Data>4.5.0.1499</Data>
          <Data>4bcfaeb5</Data>
          <Data>ListenServer.dll</Data>
          <Data>4.5.0.1499</Data>
          <Data>4bcfb083</Data>
          <Data>c0000005</Data>
          <Data>0000f350</Data>
          <Data>
          </Data>
          <Data>
          </Data>
          <Data>
      C:\Windows\Temp\WER19D2.tmp.appcompat.txt
      C:\Windows\Temp\WER532B.tmp.WERInternalMetadata.xml
      C:\Windows\Temp\WER536A.tmp.hdmp
      C:\Windows\Temp\WER5B76.tmp.mdmp</Data>
          <Data>C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_FrameworkServ ice_1f0b9b24abdad98a4a6afa022a2429637467b9_00406c26</Data>
          <Data>
          </Data>
          <Data>0</Data>
          <Data>fcbd68e1-bcaf-11df-84fe-005056c00008</Data>
          <Data>0</Data>
        </EventData>
      </Event>
      Log Name:      Application
      Source:        Windows Error Reporting
      Date:          10/09/2010 9:50:08
      Event ID:      1001
      Task Category: None
      Level:         Information
      Keywords:      Classic
      User:          N/A
      Computer:      myPC.xx.xx
      Description:
      Fault bucket , type 0
      Event Name: APPCRASH
      Response: Not available
      Cab Id: 0

      Problem signature:
      P1: FrameworkService.exe
      P2: 4.5.0.1499
      P3: 4bcfaeb5
      P4: ListenServer.dll
      P5: 4.5.0.1499
      P6: 4bcfb083
      P7: c0000005
      P8: 0000f350
      P9:
      P10:

      Attached files:
      C:\Windows\Temp\WER19D2.tmp.appcompat.txt
      C:\Windows\Temp\WER532B.tmp.WERInternalMetadata.xml
      C:\Windows\Temp\WER536A.tmp.hdmp
      C:\Windows\Temp\WER5B76.tmp.mdmp

      These files may be available here:
      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_FrameworkService_1f0b9 b24abdad98a4a6afa022a2429637467b9_cab_16fc5dd4

      Analysis symbol:
      Rechecking for solution: 0
      Report Id: fcbd68e1-bcaf-11df-84fe-005056c00008
      Report Status: 4
      Event Xml:
      <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
        <System>
          <Provider Name="Windows Error Reporting" />
          <EventID Qualifiers="0">1001</EventID>
          <Level>4</Level>
          <Task>0</Task>
          <Keywords>0x80000000000000</Keywords>
          <TimeCreated SystemTime="2010-09-10T07:50:08.000000000Z" />
          <EventRecordID>18509</EventRecordID>
          <Channel>Application</Channel>
          <Computer>myPC.xx.xx</Computer>
          <Security />
        </System>
        <EventData>
          <Data>
          </Data>
          <Data>0</Data>
          <Data>APPCRASH</Data>
          <Data>Not available</Data>
          <Data>0</Data>
          <Data>FrameworkService.exe</Data>
          <Data>4.5.0.1499</Data>
          <Data>4bcfaeb5</Data>
          <Data>ListenServer.dll</Data>
          <Data>4.5.0.1499</Data>
          <Data>4bcfb083</Data>
          <Data>c0000005</Data>
          <Data>0000f350</Data>
          <Data>
          </Data>
          <Data>
          </Data>
          <Data>
      C:\Windows\Temp\WER19D2.tmp.appcompat.txt
      C:\Windows\Temp\WER532B.tmp.WERInternalMetadata.xml
      C:\Windows\Temp\WER536A.tmp.hdmp
      C:\Windows\Temp\WER5B76.tmp.mdmp</Data>
          <Data>C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_FrameworkServic e_1f0b9b24abdad98a4a6afa022a2429637467b9_cab_16fc5dd4</Data>
          <Data>
          </Data>
          <Data>0</Data>
          <Data>fcbd68e1-bcaf-11df-84fe-005056c00008</Data>
          <Data>4</Data>
        </EventData>
      </Event>
      Log Name:      Application
      Source:        Application Error
      Date:          10/09/2010 9:49:49
      Event ID:      1000
      Task Category: (100)
      Level:         Error
      Keywords:      Classic
      User:          N/A
      Computer:      myPC.xx.xx
      Description:
      Faulting application name: FrameworkService.exe, version: 4.5.0.1499, time stamp: 0x4bcfaeb5
      Faulting module name: ListenServer.dll, version: 4.5.0.1499, time stamp: 0x4bcfb083
      Exception code: 0xc0000005
      Fault offset: 0x0000f350
      Faulting process id: 0xbec
      Faulting application start time: 0x01cb50bc05cc37a1
      Faulting application path: C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
      Faulting module path: C:\Program Files (x86)\McAfee\Common Framework\ListenServer.dll
      Report Id: fcbd68e1-bcaf-11df-84fe-005056c00008
      Event Xml:
      <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
        <System>
          <Provider Name="Application Error" />
          <EventID Qualifiers="0">1000</EventID>
          <Level>2</Level>
          <Task>100</Task>
          <Keywords>0x80000000000000</Keywords>
          <TimeCreated SystemTime="2010-09-10T07:49:49.000000000Z" />
          <EventRecordID>18508</EventRecordID>
          <Channel>Application</Channel>
          <Computer>myPC.xx.xx</Computer>
          <Security />
        </System>
        <EventData>
          <Data>FrameworkService.exe</Data>
          <Data>4.5.0.1499</Data>
          <Data>4bcfaeb5</Data>
          <Data>ListenServer.dll</Data>
          <Data>4.5.0.1499</Data>
          <Data>4bcfb083</Data>
          <Data>c0000005</Data>
          <Data>0000f350</Data>
          <Data>bec</Data>
          <Data>01cb50bc05cc37a1</Data>
          <Data>C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe</Data>
          <Data>C:\Program Files (x86)\McAfee\Common Framework\ListenServer.dll</Data>
          <Data>fcbd68e1-bcaf-11df-84fe-005056c00008</Data>
        </EventData>
      </Event>

       

       

      I'll try installing VSE8.7i Patch 3 later today.

       

      regards
      Dave

       

       

      Message was edited by: mcdave on 10/09/10 04:37:18 CDT
        • 1. Re: Management agent problems
          mcdave

          Installed VSE 8.7i Patch 3.

          But the issues remains

           

          I also can't unlock the password protected virusscan console (wrong password message) while I'm 200% sure it's correct one.
          This is  probably a side effect I presume?

           

          But when I check the eposerver the client does get synced, he virusdef files still getting updated (client task distributes from eposerver)?

           

           

          UPDATE: reinstalling Management Agent didn't help as well

           

           

          Message was edited by: mcdave on 10/09/10 04:42:18 CDT