4 Replies Latest reply: Aug 16, 2014 6:51 AM by flo84 RSS

    IIS-Error after applying VirusScan 8.8 Patch 4

    flo84

      Hi everyone,

      after upgrading VirusScan 8.8 Patch 3 to 8.8 Patch 4 I'm discovering error messages in the application eventlog on all our IIS Servers (including WSUS). OS: Windows Server 2008 R2, all MS-patches are installed.

       

      Error ID 1000, Source "Application Error", Message (translated from german into english):

      Application: svchost.exe_WAS, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc3c1

      Faulty modules: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000

      Exceptioncode: 0xc0000005

      Erroroffset: 0x00000000019bc6f7

      ID of the faulty process: 0x6cd0

      Start time of the faulty app: 0x01cfad5cac8e1fc2

      Path of the faulty app: C:\Windows\system32\svchost.exe

      Path of the faulty modules: unknown

       

      A few seonds befor this error occurs there is an information message in the system eventlog, ID 5074, Source WAS:

      A worker process with process id "58844" for application pool "WsusPool" has required a reuse because the worker process has reached it's processing time limit (in german: Ein Arbeitsprozess mit der Prozess-ID "58844" für den Anwendungspool "WsusPool" hat die Wiederverwendung angefordert, da der Arbeitsprozess das zulässige Verarbeitungszeitlimit erreicht hat.)

       

      As I wrote: after this informational message the error occurs. The WWW-Publishing and Windows Process Activation service crashes and starts again, so the problem is not very critical, but I want to find a solution for this. We never got this error(s) before, they came up after deploying patch 4 for VirusScan 8.8. I already contacted the McAfee support - but without a solution yet (at the moment I'm waiting for an answer). Because we are getting this errors on all our W2k8R2 Servers that has IIS/WSUS installed on it I can't believ there is no one out there having the same problems/errors!? The McAfee support guy asked me to follow the McAfee Best Practice Guide to add the recommended exceptions/exclusions into the ePO policy - I did that but without success, the errors are still there.

       

      Is anyone out there who is having the same problem and knows how to fix it? :-)

       

      Thanks! Florian

        • 1. Re: IIS-Error after applying VirusScan 8.8 Patch 4
          masrizal

          Hi there,

           

          I'm also facing this problem.

           

          Had patch the server on 10th May(after upgrading VirusScan 8.8 Patch 3 to 8.8 Patch 4) and starting from 11th May the issue started.

           

          Almost 1-2 time a week the error will cause the Win2008R2 IIS AppPool to go down 20times now since 10th May and in 2 recent case it do not automatically recover with IISreset or AppPool recycle. Had to manually create a new AppPool to bring up the site.

           

          No problems before this patch was applied and also latest on MS patches as of 27 April.

           

          Hope to get a resolution for this issue.

           

          Thanks and Regards,

          Masrizal

          • 2. Re: IIS-Error after applying VirusScan 8.8 Patch 4
            pato

            Have you read the release notes of patch 4? I'm fairly sure there was a known issue mentioned with IIS and maybe .Net applications (or only IIS).

            • 3. Re: IIS-Error after applying VirusScan 8.8 Patch 4
              flo84

              Thank you for your answer. You are talking about this article, don't you? McAfee KnowledgeBase - VirusScan Enterprise 8.8 Patch 4 Known Issues

               

              There is one IIS-problem in the list: ... Issue: The W3WP.exe process on web servers may exhibit high CPU after installing VSE 8.8 Patch 4. ...


              The thing is: that's not really my problem :-) But I got an answer from McAfee Support and it seems that the hint the guy gave me fixed the problem. You have to modify your VirusScan 8.8 policy and add some exclusions for "On-Access Default Processes Policies", "On-Access Low-Risk Processes Policies" and "On-Access High-Risk Processes Policies":


              **\System32\Inetsrv\

              **\IIS Temporary Compressed Files\

              **\MNS_FSW_DIR*\

               

              And I added w3wp.exe in "On-Access Low-Risk Processes Policies" as a "Low Risk Process" + uncheck the checkboxes "When writing to disk" and  "When reading from disk" (but ONLY for Low-Risk Processes!!!).  I made this changes yesterday - no errors since that time. But as I mentioned in my prevoius post it happens spontaneously that the IIS service crashes...So I'll wait 2 more days and let you know if the problem is definitely fixed.


              PS: have a look at the VirusScan 8.8 Best Practice Guide for more details: https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/ 22000/PD22940/en_US/vse_880_best_practic…


               

              • 4. Re: IIS-Error after applying VirusScan 8.8 Patch 4
                flo84

                OK - the problem was solved by adding the exlusions I mentioned in my previous post. Case closed :-)