8 Replies Latest reply on May 8, 2008 11:20 AM by Grif

    When accessing network shares clients blue screen or reboot

      Hello,
      We have just deployed 8.5 Patch 5 to all users (xp and 2000) when a user will access a shared directory or the admin share the "sharing" computer will blue screen or reboot (this occurs only on workstations not any servers). Anybody heard of this? I put in a support call and McAfee has not heard of this one !!

      Any help is appreciated!!

      Thanks!
      Dave
        • 1. RE: When accessing network shares clients blue screen or reboot
          We turn off network scanning in the "On Access Scanning" settings to prevent this.

          Hope this helps.

          Grif
          • 2. Thanks for replying
            Hey Grif,
            Do you mean on the "Detection" tab to uncheck "ON Network Drives"? Currently we do not have that checked. I am however doing some testing with the taking the "block connection" off.

            Thanks!
            Dave
            • 3. RE: Thanks for replying
              Dave,

              Yes, it's the "On Network Drives" option in "Detection". If it's already UNCHECKED, then that's not the issue..

              Another thought.. Rebooting of the computer is usually a symptom of hardware issues.. How many computers are having the problem? Are they old machines with little RAM and/or poor power supplies? I would certainly investigate that possibility.

              Hope this helps.

              Grif
              • 4. still having issues
                Hey Grif,
                We are still having issues. I tried turning off "blocking" and the same results. I know of at least a half a dozen or so systems that are having this problem. Could be more but they don't crop up until somebody will access a "shared" file. They are fairly new systems all with at least a Gb of memory. I'm sending Mcafee my dump file from my own system that is doing this and hopefully they will figure out what is going on?

                Thanks!
                Dave
                • 5. RE: still having issues
                  Dave,

                  Thanks for the reply.. Strange issue since we're not having those issues and we share files and map network drives constantly.

                  Is this "Vista" or XP that's having the problem.. Currently, Vista isn't fully supported till Patch #6 comes out..

                  Just a thought. Are the "On Access" settings in the "Detection" tab scanning "All Files"? What happens if you change that setting to "Default" files?

                  Hope this helps.

                  Grif
                  • 6. RE: still having issues
                    Grif,
                    We are running XP and windows 2000 only. Setting the "default" files did not work either. I am stepping "way back" and trying to isolate the problem.

                    Thanks for your help!
                    Dave
                    • 7. I think I solved the problem
                      Resolution:
                      We run an end point protection software called “Sanctuary” which “masked” the real problem. When a blue screen would occur we got a 0x00000024 error. Very generic error!. Once I uninstalled the Sanctuary software the “true” error was unveiled.
                      The error was with the “mfetdik.sys” file the McAfee Anti-Virus Mini-Firewall Driver.
                      On our workstations we run an older Veritas backup software called “Veritas Netback Professional version 3.6”. In the following Mcafee support article https://knowledge.mcafee.com/article/905/KB40024_f.SAL_Public.html it talks about the vsp.sys file conflicting with the mfetdik.sys file.

                      From that article it led me to the following Veritas article http://seer.entsupport.symantec.com/docs/295599.htm which talks about renaming the mfetdik.sys file which removes the functionality provided by this file (port blocking access protection rules and identification of source IP Address for a remote attacker). You need to stop the Mcafee service before you can rename this file by the way.

                      I renamed this file and so far so good. This seems to have solved the problem!!
                      I am doing more extensive testing now with more users!! I hope this helps others with the same problem? I will post again in a few days to let everyone know my final results.
                      • 8. RE: I think I solved the problem
                        Good job Dave! And thanks for posting back.

                        Grif