1 2 Previous Next 10 Replies Latest reply on Jan 12, 2009 8:52 AM by fad3r

    VS 8.5 Patch 3 Service constantly pausing and starting

      Hello,

      On every server in our environment we continually get these messages:

      The McAfee McShield service entered the paused state.

      For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

      The McAfee McShield service entered the running state.

      For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

      This happens every 5 minutes and 2 seconds one message then the other. Then another 5 minutes and 2 seconds and the same thing.

      Is this normal behavior? If not does anyone have an idea of what is causing it?
        • 1. RE: VS 8.5 Patch 3 Service constantly pausing and starting
          twenden
          McAfee is aware of this issue. They told me that it should not cause any problems. If you want to get rid of this message then please refer to Document ID: 614077 on the McAfee knowledge base


          Below is some info from this document:

          Problem

          The Windows System Event log is populated with multiple entries for Event ID 7036 after applying VirusScan Enterprise (VSE) 8.5i. Patch 2 or later:

          Event ID: 7036, The McAfee McShield service has entered the <Running> or <Paused> state

          This issue is only reported on computers managed by ePolicy Orchestrator (ePO) or ProtectionPilot (PrP).

          This issue was resolved with HotFix 370722 which is attached to this KnowledgeBase article. In addition, both the ePO server(s) and client(s) must be restarted for this HotFix to take effect, because the ePO Server may still have events queued that must be removed.

          NOTE: This issue will be resolved in McAfee VirusScan Enterprise 8.5i Patch 5. A release date cannot be given for this Patch at this time but this article will be updated once Patch 5 is released to the web.


          After the HotFix is applied, a single instance of this event is generated after a policy enforcement when the VSE configuration policy has been modified either from the local VirusScan Console or using the ePO/PrP Console.

          NOTE: An issue was found with the previously attached HotFix 370721, which is no longer available. With HotFix 370721 applied, the property information for the Patch version was no longer reported. HotFix 370722 also resolves the reporting issue.
          • 2. Finding that knowledge base article... bad web site design
            I also have got this problem, and I was pleased to find it was already addressed. But where is document 614077?

            I went to the McAfee home page and typed the number in... Nothing. According to the search facility on the home page "614077" does not appear on the McAfee web site. Rather odd, given that it appears on this page at least.

            So where do I find any knowledge base articles? You might imagine they would be a link from the home page... No. You might think they would be in the support section. If they are, they are buried deep. I had to leave McAfee, and do a Google search to find a page on the McAfee site from which I could search the knowledge base. Every time I use the McAfee web site I find it frustrating. I have complained about it, but I think the web designers are more interested in style than content. I have never encountered such a difficult web site to use.

            For the benefit of anyone else in my position, here is a link to the relevant article:
            https://knowledge.mcafee.com/SupportSite/search.do?cmd=displayKC&docType=kc&exte rnalId=614077&sliceId=SAL_Public&dialogID=20514394&stateId=1%200%2020508971
            • 3. RE: Finding that knowledge base article... bad web site design
              Gazz300
              I am thankful that someone else finds the same problems with McAfee's Website and their half tested patches as I do! :mad:

              Patch 3 caused me the same issues and I got major trouble when I pushed this HF as it rebooted the machine when installed unannounced! Doing that in a LAB (chemical) environment is a big no no. And yes I did test but it didn't reboot my test machine.

              Take care with Patch 4 as this turned on Cookie detection reporting for On Demand scans such as a Lite scan. This pushed my ePO DB from 25GB to over 50Gb and made it unusable losing all my data for the year causing me to restore from a backup to another server for year end reports. Great when you are meant to be enjoying Christmas with the family. Sorry kids daddy has to go fix a database in work so no trip to the park today!

              If it was easy to move to Symantec I would tomorrow. I am sick to the back teeth of half tested patches that are rushed out to fix a previous mistake in a patch but cause another problem. I have spent the last two months fire fighting just because of issues passed on by Mcafee!

              Anyone seen a readme for Patch 5 yet?

              End of rant and I feel much better now. :o
              • 5. RE: Readme for Patch 5
                Gazz300


                :D:D:D

                Cheers. Release date Mid Feb according to Platinum support. Lets see what other bugs it brings and if its as good as P2 and P3? :rolleyes:

                Can't wait for the server policy to allow pausing and restarting of OA Scan under my own decision!
                • 6. Tested with Patch 5?
                  dr0h
                  Has anyone tested this problem with the (now public) release of Patch 5? I updated the majority of my servers to p5 last week, but it didn't resolve my problem.

                  The McAfee KB article 614077 says that the hotfix brings VSPLUGIN.DLL to version 8.5.0.911, but after p5 my DLL version is 8.5.0.909.

                  Has anyone else seen any changes?

                  Cheers,
                  -Joshua
                  • 7. RE: Tested with Patch 5?
                    psolinski
                    HotFix 386922 brings vsplugin.dll to 911. You can install it after P5.

                    HF is here:

                    [COLOR=#810081]https://knowledge.mcafee.com/SupportSite/search.do?cmd=displayKC& docType=kc&externalId=614077[/COLOR]
                    • 8. RE: Tested with Patch 5?
                      dr0h
                      Hi psolinski,

                      Yes I know the hotfix brings it up to that version. The question was about the patch, as the patch 5 readme specifically says it "resolves" this issue. My question was if anyone else has had this issue resolved with the lastest patch..

                      Thanks,
                      -Joshua
                      • 9. RE: Tested with Patch 5?
                        mcdave
                        I upgraded to Patch7 (VSE8.5i) but the problem still exist. ;-(

                        VSPLUGIN.DLL is version 8.5.0.930.
                        1 2 Previous Next