3 Replies Latest reply on Apr 20, 2009 9:04 AM by MitchR

    Faulting application Mcshield.exe

    tao
      Pushed 8.5i from ePO 3.61.231 (replacing 8.0i) and several users experienced an error:

      Event Type: Error
      Event Source: Application Error
      Event Category: (100)
      Event ID: 1000
      Date: 5/15/08
      User: N/A
      Computer: xxxxx
      Description:

      Faulting application Mcshield.exe, version 13.3.2.123, faulting module ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

      Also pushing patch 5 for 8.5i....After checking ePO 8.5i seems to be installed on all the units that experinced the error.....Any insight on this would be very helpful.

      TIA4P....
        • 1. On-Access Scanner Service
          Seeing the same thing here.
          It's on 64-bit Windows 2003 Standard SP2.

          On a login after a reboot, I immediately see a crash report titled "On-Access Scanner Service". Details:
          szAppName: McShield.exe
          szAppVer: 13.3.2.116
          szModName: ntdll.dll
          szModVer: 5.2.3790.3959
          offset: 0000000003bbfb

          There are no event logs relating to this crash.

          Attempting to reinstall or repair the application shows no errors, however McAfee crashes immediately with no error messages or event logs.

          The "McAfee McShield" service stops when it crashes. Restarting this service does nothing- McAfee VirusScan remains in a crashed state.

          I have tried uninstalling McAfee & the EPO, deleting all McAfee files in C:\Program Files, rebooting, and reinstalling. Same error.
          • 2. RE: On-Access Scanner Service
            Have you already run McAfee Virusscan Enterprise 8.5 Patch 8? See also here. Please ensure you are running the latest patches and updates.
            • 3. On-Access Scanner Service crashes
              Follow up for others having the same problem.

              When trying to applying the latest patch, #8, the installer would halt with an error at the first screen.

              Called in to McAfee support, and after a little troubleshooting, found the fix:
              -Completely uninstall all traces of McAfee files & registry entries. (They had a tool to do this)
              -Reboot
              -Manually download the latest VirusScan Enterprise 8.5i, and manually install
              -Manually re-install our EPO package
              -Reboot

              The system is now working. I applied SP8 on top of this install, just in case.

              I will note that shortly after reinstalling the EPO, there were some scary Event log errors & a DrWatson - but they only happened once. Several reboots & a weekedn later, things look OK. There is an article about the ID 5019 error that seems to apply, saying this a one-time error from an upgrade.

              Source: McLogEvent, ID: 5019
              Source: Application Error, ID: 1000
              Source: DrWatson, ID: 4097
              Source: McLogEvent, ID: 1008