This content has been marked as final. Show 6 replies
same problem here, only on a handful of clients, all are XP sp3, on different hw (though one is exactly hp 7900, but with vista ent).
I checked out logs, policies and whatever to no avail. tried to reinstall the client, agent etc many times. No way.
I even updated EPO to patch 4 and EPO client to patch 2, same results.
and I checked the bStartDIsabled registry key on the affected computers - it s 0 - so it should be correct. Tried removing the agent (frminst /remove=agent) and starting the service mcshield and it worked. Reinstalling the agent makes the OAS stop.
The strange thing is, it seems to be a policy related problem, but the rest of the clients are working properly with the same config.
In the affected clients local console "enable acces protection" and "prevent mcafee services from being stopped" are unchecked; if I check the boxes, the next policy enforcement will put them back unchecked. And, I must make clear, the policy is the same for all. So I create and applied a new policy to the misfunctioning clients, same stuff.
It seems this problem is slowly expanding here...
called McAfee Support and got the following, that worked for me:
Microsoft Windows (All supported versions. See KB51109)
HP pre-installed software HP DC9500 Laptop
VirusScan Enterprise (VSE) 8.7i is disabled on system startup with HP pre-installed software on an HP DC9500 laptop.
The Virusscan Enterprise 8.7i icon in taskbar shows a red circle with a line through it.
The following error is reported in the Application Event Viewer:
ERROR: Event id : 5004, Could not contact Filter Driver. Error =0x7d1 : The system cannot find the file specified
A conflict between On Access Scanner protection and HP pre-installed software causes the computer to become instabile.
Remove the HP pre-installed software such as Altiris prior to installing McAfee VirusScan Enterprise 8.7i. HP pre-installed software can be safely reinstalled after VirusScan is installed.
I uninstalled Altiris something agent, and rebooted, and problem was gone, according to the supporter you should be able to install the Altiris product again, but don't know, and really do not care what it is for, so I never bothered reinstalling it...
no luck for me... called mcafee, did what was suggested in KB59863 to no avail. I repeated the procedure with a mcafee tech and showed him I was able to reproduce the error in spite of the registry mod.
so I got an official response, somewhat smoky though: "mcafee is aware of the problem and it will be solved in patch 1 for 8.7, inn the meantime rollback to 8.5 until the patch is released at the end of this month".
I got it working but it takes a lot more effort than it should. Uninstall the preinstalled antivirus (or decline the license agreement). Install VSE8.7 and reboot. OAS will be disabled, reinstall VSE and make the following changes:
- Navigate to HKLM\System\CurrentControlSet\Services\[mfebopk, mfeapfk, mfeavfk]
- Modify the ImagePath to be the full path to the driver.
e.g. Instead of "system32\drivers\mfebopk.sys" change it to "C:\Windows\System32\Drivers\mfebopk.sys"
Reboot. This gets it working for me most of the time. It's important that you only change those exact 3 registry keys. (because there are 5 or 6 of them, but somehow if you change them all to full path, it doesn't work)
The above fix appears to be the same fix for the dynamic hard disks issue.
Thank you very much Erlendv, It really works, I did the changes in a few seconds and bingo! After reboot, my OAS started automatically. you`re a life saver!