6 Replies Latest reply on Aug 11, 2009 11:40 PM by eagle2

    VSE 8.7i - McAfee OAS: Disabled


      I have a problem on two newly installed computers at two different customers. It's brand new HP dc7900's downgraded to Windows XP, and on both of them McAfee OAS continues to get disabled...

      I've tried to start it in Services starting McAfee McShield, but that stops telling me that services with no jobs to do will be stopped...

      I've tried reinstalling 3 times...

      I've never seen this kind of problem before... I've called HP support to no avail, they just asked me to contact McAfee, though i told him this ploblem seem to be isolated to HP computer downgraded to XP...

      Please help !!!

      Frank Sonne
        • 1. RE: VSE 8.7i - McAfee OAS: Disabled

          same problem here, only on a handful of clients, all are XP sp3, on different hw (though one is exactly hp 7900, but with vista ent).
          I checked out logs, policies and whatever to no avail. tried to reinstall the client, agent etc many times. No way.
          I even updated EPO to patch 4 and EPO client to patch 2, same results.
          and I checked the bStartDIsabled registry key on the affected computers - it s 0 - so it should be correct. Tried removing the agent (frminst /remove=agent) and starting the service mcshield and it worked. Reinstalling the agent makes the OAS stop.
          The strange thing is, it seems to be a policy related problem, but the rest of the clients are working properly with the same config.
          In the affected clients local console "enable acces protection" and "prevent mcafee services from being stopped" are unchecked; if I check the boxes, the next policy enforcement will put them back unchecked. And, I must make clear, the policy is the same for all. So I create and applied a new policy to the misfunctioning clients, same stuff.
          It seems this problem is slowly expanding here...
          Please help,
          N. Grep
          • 2. Solution

            called McAfee Support and got the following, that worked for me:

            Microsoft Windows (All supported versions. See KB51109)
            HP pre-installed software HP DC9500 Laptop
            Problem 1
            VirusScan Enterprise (VSE) 8.7i is disabled on system startup with HP pre-installed software on an HP DC9500 laptop.

            The Virusscan Enterprise 8.7i icon in taskbar shows a red circle with a line through it.
            Problem 2
            The following error is reported in the Application Event Viewer:
            ERROR: Event id : 5004, Could not contact Filter Driver. Error =0x7d1 : The system cannot find the file specified
            A conflict between On Access Scanner protection and HP pre-installed software causes the computer to become instabile.
            Remove the HP pre-installed software such as Altiris prior to installing McAfee VirusScan Enterprise 8.7i. HP pre-installed software can be safely reinstalled after VirusScan is installed.


            I uninstalled Altiris something agent, and rebooted, and problem was gone, according to the supporter you should be able to install the Altiris product again, but don't know, and really do not care what it is for, so I never bothered reinstalling it...

            Frank Sonne
            • 3. RE: Solution

              no luck for me... called mcafee, did what was suggested in KB59863 to no avail. I repeated the procedure with a mcafee tech and showed him I was able to reproduce the error in spite of the registry mod.
              so I got an official response, somewhat smoky though: "mcafee is aware of the problem and it will be solved in patch 1 for 8.7, inn the meantime rollback to 8.5 until the patch is released at the end of this month".
              • 4. RE: Solution
                I got it working but it takes a lot more effort than it should. Uninstall the preinstalled antivirus (or decline the license agreement). Install VSE8.7 and reboot. OAS will be disabled, reinstall VSE and make the following changes:

                - Navigate to HKLM\System\CurrentControlSet\Services\[mfebopk, mfeapfk, mfeavfk]
                - Modify the ImagePath to be the full path to the driver.
                e.g. Instead of "system32\drivers\mfebopk.sys" change it to "C:\Windows\System32\Drivers\mfebopk.sys"

                Reboot. This gets it working for me most of the time. It's important that you only change those exact 3 registry keys. (because there are 5 or 6 of them, but somehow if you change them all to full path, it doesn't work)

                Good luck!
                • 5. RE: Solution
                  The above fix appears to be the same fix for the dynamic hard disks issue.
                  • 6. Thanks

                    Thank you very much Erlendv, It really works, I did the changes in a few seconds and bingo! After reboot, my OAS started automatically. you`re a life saver!