1 2 3 4 Previous Next 30 Replies Latest reply on Aug 28, 2008 7:38 AM by Chadder007

    VirusScan 8.5i Patch 6 Available

      VirusScan 8.5i Patch 6 available in the service portal.

      Latest Readme information in article 615747:
      https://knowledge.mcafee.com/SupportSite/search.do?cmd=displayKC&docType=kc&exte rnalId=615747
        • 1. RE: VirusScan 8.5i Patch 6 Available

          So far, I've installed it on 4 or 5 test machines (Windows XP SP3 and Windows 200 SP4) and there have been no problems during the install or during a scan.. Checking "About VirusScan Enterprise" shows "Installed Patches" as "6" which is correct.

          Not much else to report at this time..

          Hope this helps.

          • 2. RE: VirusScan 8.5i Patch 6 Available
            No problem here
            • 3. I have found a problem
              I started deploying to several systems and immediately we found that the McShield would spike to 50 percent. Thisa would stay that way until either the system was rebooted or the service was stopped and restarted. I found this on servers, workstations and laptops. It seems to be about half of the machines I deployed to which was around 100.
              • 4. Confirmed.

                Confirming the same behavior.

                Though minor on workstations, since a reboot fixes the issue, on servers this can be significant.

                I noted 2 instances of McShield.exe running. The most recently running spid for McShield is the one that seems to be in a race condition.

                At time of update:

                6/26/2008 12:21:35 PM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\WINDOWS\system32\services.exe C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate

                I suspect this setting will be found on systems that have this behavior. The new McShield.exe must be in a race condition with the original McShield.exe already running, but not stopped.

                I would suggest on systems such as servers that cannot be restarted easily, turning off 'Common Standard Protection:Prevent termination of McAfee processes' prior to running the update, then turning it back on after the update is complete.

                Ron Metzger
                • 5. glad not to be the only one
                  I got the same access protection rule notifications. One thing I noticed is I allowed the termination of the mcshield process and upon stoppping the mcshield service and restarting it, I then have two mcshield.exe running. Just out of curiosity, did you contact Mcafee Support yet?
                  • 6. RE: glad not to be the only one
                    We restarted all our test computers immediately after installation of the Patch and as a result, we didn't see the issue.

                    Hope this helps.

                    • 7. RE: glad not to be the only one

                      No, I did not contact McAfee Support. Though, I wish the problem did not happen.

                      I wonder if both McShield.exe processes are the same or are they from each version. I will investigate this on the next encounter. Also, would a simple logoff/logon clear the problem, instead of a full reboot.

                      Ron Metzger
                      • 8. RE: glad not to be the only one
                        Logoff /Logon did not work for me. What i had to do was temporarily remove the check mark in the block field for "Prevent termination of McAfee processes" Then kill the two McShield.exe processes in task manager. This will disable Access Protection, Buffer Overflow Protection and the On-Access Scanner. I was able to enable the Access Protection & Buffer Overflow Protection by right clicking tehm in the VirusScan Console. The On-Access Scanner's enabled option is grayed out in the VirusScan Console but pushing a wake-up call from the ePO server re-enabled the On-Access Scanner. This saved me from having to reboot half of my servers yesterday morning.
                        • 9. contact mcafee
                          I recommend anyone who sees this problem to contact Mcafee, I contacted them and they said they have received no calls on this and that they could not duplicate. I see it on almost 70 percent of the deploys. They wont start investigating the issue unless they receive more calls with the exact same issue.
                          1 2 3 4 Previous Next