1 Reply Latest reply on May 11, 2012 5:28 AM by rackroyd

    Agent not starting after Windows Update

      Hi,

      after a Windows Update cycle, the agents on all machines refuse to start.

      Currently the agent only gets as far as the "Cryptshim" line:

       

      2012-05-11 09:41:45 I #5100 FrmSvc START cmdline="C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart

      2012-05-11 09:41:45 I #5100 FrmSvc ServiceStart

      2012-05-11 09:41:45 I #5100 FrmSvc Running

      2012-05-11 09:41:45 I #5116 FrmSvc Starting Subsystem

      2012-05-11 09:41:45 x #5116 Logging Subsystem started

      2012-05-11 09:41:45 I #5116 FrmSvc Starting Subsystem

      2012-05-11 09:41:45 I #5116 FrmSvc Starting Subsystem

      2012-05-11 09:41:45 I #5128 Manage Mangement plugin watch worker thread started

      2012-05-11 09:41:45 I #5116 Cryptshim Initializing crypto library

      2012-05-11 09:41:45 I #5116 Cryptshim Using C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\keystore as keystore path

      2012-05-11 09:41:45 I #5116 Cryptshim Using C:\Program Files\McAfee\Common Framework\FrameworkService.sig as exe signature file path 2012-05-11 09:41:45 I #5116 MfeCryptC RSA version : NIST Library Version 2.1.0.0

      2012-05-11 09:41:45 I #5116 MfeCryptC

      2012-05-11 09:41:45 I #5116 MfeCryptC RSA crypto role : User Role

      2012-05-11 09:41:45 I #5116 MfeCryptC

      2012-05-11 09:41:45 I #5116 MfeCryptC RSA crypto mode : NON-FIPS Mode

      2012-05-11 09:41:45 I #5116 MfeCryptC

      2012-05-11 09:41:45 I #5116 Cryptshim Successfully initialized crypto library

       

      The error log shows:

      2012-05-11 09:00:53 e #4656 FrmSvc Failed to start Subsystem , result=-13

      2012-05-11 09:00:53 e #4656 FrmSvc Failed to start Subsystem , result=-13

      2012-05-11 09:00:54 e #4656 Updater

      2012-05-11 09:00:54 e #4656 FrmSvc Failed to start Subsystem , result=-13

      2012-05-11 09:00:54 E #4656 Sched pFactory->RegisterFrameworkCallback--CSchedule::InitFwInterface hr=0xfffffff3 : Unknown error code

      2012-05-11 09:00:54 E #4656 Sched <<--CSchedule::InitFwInterface hr=0xfffffff3 : Unknown error code

      2012-05-11 09:00:54 E #4656 Sched <<--CSchedule::Start hr=0x80004005 : Unspecified error

      2012-05-11 09:00:54 e #4656 FrmSvc Failed to start Subsystem , result=-2147467259

      2012-05-11 09:00:55 e #4656 FrmSvc Failed to start Subsystem , result=-13

      In the windows event log I am seeing "Faulting application FrameworkService.exe version v.4.6.0.2292, faulting module msvcr80.dll, version 8.0.50727.3053, fault address 0x00008aa0

       

      This is a standard Windows 2003 server running agent 4.6.0 2292.

       

      So far I´ve tried

      - rebooting the server

      - adding the frameworkservice.exe to the DEP exceptions

      - DCOM permissions as per Mcafee knowledgebase article

      - Placing a machine in an OU without any policies (same article)

       

      This is the 2nd time this happened, last time I assumed it was because some of the agents were originally version 4 and had been upgraded.  I then manually removed all of the agents by hand and reinstalled both Agent & VSE from scratch .  The machines are all in different DMZ zones, so it is not possible to just do a redeployment of the agent from EPO.

       

       

      Thanks in advance

       

       

       

      on 11.05.12 04:36:24 CDT