3 Replies Latest reply on Oct 2, 2012 1:45 PM by Hayton Branched from an earlier discussion.

    mcupdmgr.exe rebooting - event log messages

      MCUPDMGR.EXE initiated a reboot without warning on my computer. My initial suspicion was if it was a virus or some malware or spyware of some kind. Further research on mcafee community did not reveal much. I have my event logs and don't know who to send it to for further investigation.

       

       

      From event logs, I noticed that prior to MCUPDMGR.EXE initiated the reboot, MCafee crashed and after an elapsed time of 5000 milli seconds was restarted by the OS. In the build up to the forced reboot, several attempts to hack my computer from some unknown host, just pasting a few of them below (the events repeat quite a few times).

       

      An SSL 3.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.

       

       

      The following fatal alert was generated: 40. The internal error state is 107.

      And other system related errors after a few attempts to crack my pc as seen below after which pc rebooted itself.

       

       

       

      The Windows Error Reporting Service service entered the stopped state.

       

      The Windows Modules Installer service entered the stopped state.

       

       

       

       

      What is MCUPDMGR.EXE? Why is there no information about this process anywhere in MCafee website? All I see / read is some assumptions in this post MCafee process but no official confirmation / evidence. In some other posts in the same mcafee community website, I could see MCUPDMGR is linked to some kind of virus.

       

      Message was edited by: Hayton : amended subject header -  on 02/10/12 11:31:29 IST
        • 1. mcupdmgr.exe rebooting - event log messages
          Peacekeeper

          The reboot without warning happens if you get a popup saying restart required and you say not now. Then if you do not reboot in 30mins or so it euther reasks and if no answer reboots or reboots without asking. Did you get a popup?

           

          That said pointing the mcafee admin here he wants the logs you have and needs to take some mer logs of your PC so they can stir the developers up. My son in law and duaghter recently saw this as well so I am getting teir logs as well. Would you be interested in helping?

           

          Message was edited by: Hayton : amended subject header -  on 02/10/12 11:32:04 IST
          • 2. mcupdmgr.exe rebooting - event log messages
            Hayton

            @sathish297 :

            The "Error code 40 / Internal error state 107" message shows that this is an SChannel (SSL Handshake) problem.

             

            Since you haven't said what your OS is, or which version of IE you have, or what your McAfee program/version is, or whether McAfee, Windows, and other programs are up to date, or whether you have run scans with McAfee or other programs to ensure that you don't have a malware infection, then the best I can offer is some generic advice and information.

             

            Check your Internet Explorer settings (Tools-->Internet Options-->Advanced) and go to the end. Check whether IE is using TLS and/or SSL and which versions : McAfee uses Internet Explorer settings for its operations and this may have a bearing on the messages you are seeing. In your IE Security Settings also check your Software channel permissions - are they set High, Low or Medium?

             

            http://community.spiceworks.com/topic/231144-schannel-errors-36888-and-36874-on- citrix-xenapp-6-5-server-2008r2

            Schannel Errors 36888 and 36874 on Citrix XenApp 6.5 server 2008R2 - Spiceworks.png

             

             

            The message is commonly seen on servers and can be disabled by setting a registry value to 0. You haven't said if your machine is a server but I assume not. See the following Microsoft discussions anyway.

            http://social.technet.microsoft.com/Forums/en-US/exchange2010/thread/7b95a21c-67 fc-49a9-8198-b9e364523d27/

            http://social.technet.microsoft.com/Forums/sk/winserversecurity/thread/a87505a3- 1fd0-47b3-b6db-d36444da34fc

             

            This error can be received due to an incompatible browser problem and SSL 3.0 connection request cannot be handled.

             

            There may be a separate issue to do with digital certificates - a missing, expired or invalid certificate, or an encryption method not supported by a program on your system. There isn't enough information to be able to say more than "maybe".

             

            Message was edited by: Hayton - amended subject header -  on 02/10/12 11:32:32 IST
            • 3. Re: mcupdmgr.exe rebooting - event log messages
              Hayton

              Additional : your question has been branched to a separate thread. Please do not post a question in multiple places, please do not tack a question on to an Answered thread, and please do not hijack an old and possibly unrelated thread with a me-too post. The best thing is to ask your question in a separate thread, since your system configuration will be different from that of other posters.

               

              As for your query about mcupdmgr : no it is not linked to any virus. I don't know where you got that idea from. It's the  McAfee Update Manager.

               

              http://www.bleepingcomputer.com/startups/mcupdmgr.exe-7992.html

              http://www.processlibrary.com/directory/files/mcupdmgr/29066/

               

               

              Edit - Thread moved out of Service & Support to General Discussion

               

              Message was edited by: Hayton on 02/10/12 19:45:15 IST