4 Replies Latest reply on Sep 21, 2010 2:20 PM by jstanley

    McAfee Agent 4 "uninstalls" on login

      I am currently in the process of migrating machines from our old 3.6.1 server with 3.6 agents to a new epo 4 server using agent 4. Most of the installs work fine, just by manually adding the client in to epo 4 and sending an agent install, however 2 of the machines are encountering problems.

      Pushing the 4.0 agent to them from epo 4 works fine, they talk to the server and receive policies and updates. Next time the machines is rebooted and the user logs in, a McAfee Agent dialogue box appears in the middle of the screen saying Configuring McAfee Agent (as though the agent .msi installer had been run), then after a couple of seconds says Cancelling, and the dialogue box disappears. The agent icon also disappears from the system tray, and although the framework service is still running, it no longer communicates on port 8081.

      Further symptoms: The machines application event log generates 9 or 10 MsiInstaller errors:

      Event Type: Warning
      Event Source: MsiInstaller
      Event Category: None
      Event ID: 1001
      Date: 29/08/2008
      Time: 11:17:28
      User: domain\username
      Computer: pcname
      Description:
      Detection of product '{A638557B-1F13-40A0-9627-C892FBCA6960}', feature 'Main' failed during request for component '{E9CC57F0-E5EA-41B6-B449-2C67AD7A429B}'


      ({A638557B-1F13-40A0-9627-C892FBCA6960} is the CLSID for McAfee Agent)
        • 1. RE: McAfee Agent 4 "uninstalls" on login
          Agent log from one of the affected machines:

          This is part of the agent log from one of the affected PCs:

          2008-08-29 09:16:46 I #596 FrmSvc START cmdline="C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart
          2008-08-29 09:16:46 I #596 FrmSvc ServiceStart
          2008-08-29 09:16:46 I #596 FrmSvc Running
          2008-08-29 09:16:48 I #648 FrmSvc Starting Subsystem <Logging>
          2008-08-29 09:16:48 x #648 Logging Subsystem started
          2008-08-29 09:16:48 I #648 FrmSvc Starting Subsystem <User Space Controller>
          2008-08-29 09:16:49 I #648 FrmSvc Starting Subsystem <Management>
          2008-08-29 09:16:49 I #820 Manage Mangement plugin watch worker thread started
          2008-08-29 09:16:51 x #648 Manage Subsystem started
          2008-08-29 09:16:52 I #648 FrmSvc Starting Subsystem <Updater>
          2008-08-29 09:16:52 I #648 updsubs Starting updater subsystem
          2008-08-29 09:16:52 i #648 Updater Subsystem started
          2008-08-29 09:16:52 I #648 FrmSvc Starting Subsystem <Scheduler>
          2008-08-29 09:16:52 I #648 Sched >>--CSchedule::Start
          2008-08-29 09:16:52 I #648 Sched Glbs.szMyPlatform: W2KW:5:0:4
          2008-08-29 09:16:52 I #648 Sched Product Deployment - Last run time(local) is Tue Aug 26 17:55:14 2008
          2008-08-29 09:16:52 I #648 Sched
          2008-08-29 09:16:52 I #648 Sched Product Update - Last run time(local) is Thu Aug 28 12:35:00 2008
          2008-08-29 09:16:52 I #648 Sched
          2008-08-29 09:16:52 I #648 Sched CNaiSchedule::GetRandomizedDelayMins() : 3
          2008-08-29 09:16:53 i #648 Sched Next time(local) of task Product Update: 29 August 2008 12:33:00
          2008-08-29 09:16:53 I #648 Sched All the tasks are successfully loaded from the file
          2008-08-29 09:16:53 i #648 Sched Scheduler is now running
          2008-08-29 09:16:53 I #648 Sched <<--CSchedule::Start
          2008-08-29 09:16:53 I #648 FrmSvc Starting Subsystem <Trusted Connection>
          2008-08-29 09:16:53 I #648 TrstCon Start
          2008-08-29 09:16:53 I #648 FrmSvc Service started
          2008-08-29 09:17:42 I #648 FrmSvc Stopping Subsystem <User Space Controller>
          2008-08-29 09:17:42 I #648 FrmSvc Stopping Subsystem <Trusted Connection>
          2008-08-29 09:17:42 I #648 TrstCon Stop
          2008-08-29 09:17:42 I #648 FrmSvc Stopping Subsystem <Scheduler>
          2008-08-29 09:17:42 i #648 Sched The Scheduler is shutting down
          2008-08-29 09:17:42 i #648 Sched Scheduler is now stopped
          2008-08-29 09:17:42 I #648 FrmSvc Stopping Subsystem <Updater>
          2008-08-29 09:17:42 I #648 updsubs Stopping updater subsystem
          2008-08-29 09:17:42 i #648 Updater
          2008-08-29 09:17:42 I #648 FrmSvc Stopping Subsystem <Management>
          2008-08-29 09:17:42 I #820 Manage WorkThread - WaitForMultipleObjects = WAIT_OBJECT_0
          2008-08-29 09:17:42 I #820 Manage Mangement plugin watch worker thread terminating
          2008-08-29 09:17:42 x #648 Manage Subsystem stopped
          2008-08-29 09:17:42 I #648 FrmSvc Stopping Subsystem <Logging>
          2008-08-29 09:17:42 x #648 Logging
          2008-08-29 09:17:42 I #596 FrmSvc Set COM launch permissions and service settings
          2008-08-29 09:17:42 I #596 FrmSvc END
          2008-08-29 09:17:42 I #648 FrmSvc Service stopped
          2008-08-29 09:17:58 I #1460 FrmSvc START cmdline="C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /Service
          2008-08-29 09:17:58 I #1460 FrmSvc register service
          2008-08-29 09:17:58 I #1460 FrmSvc Set COM launch permissions and service settings
          2008-08-29 09:18:01 I #1460 FrmSvc result = 0
          2008-08-29 09:18:01 I #1460 FrmSvc END
          2008-08-29 09:18:08 I #1148 FrmSvc START cmdline="C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart
          2008-08-29 09:18:08 I #1148 FrmSvc ServiceStart
          2008-08-29 09:18:08 I #1148 FrmSvc Running
          2008-08-29 09:18:08 I #1040 FrmSvc Starting Subsystem <Logging>
          2008-08-29 09:18:08 x #1040 Logging Subsystem started
          2008-08-29 09:18:08 I #1040 FrmSvc Starting Subsystem <User Space Controller>
          2008-08-29 09:18:08 I #1040 FrmSvc Starting Subsystem <Management>
          2008-08-29 09:18:08 I #936 Manage Mangement plugin watch worker thread started
          2008-08-29 09:18:09 x #1040 Manage Subsystem started
          2008-08-29 09:18:09 I #1040 FrmSvc Starting Subsystem <Updater>
          2008-08-29 09:18:09 I #1040 updsubs Starting updater subsystem
          2008-08-29 09:18:09 i #1040 Updater Subsystem started
          2008-08-29 09:18:09 I #1040 FrmSvc Starting Subsystem <Scheduler>
          2008-08-29 09:18:09 I #1040 Sched >>--CSchedule::Start
          2008-08-29 09:18:09 I #1040 Sched Glbs.szMyPlatform: W2KW:5:0:4
          2008-08-29 09:18:09 I #1040 Sched Product Deployment - Last run time(local) is Tue Aug 26 17:55:14 2008
          2008-08-29 09:18:09 I #1040 Sched
          2008-08-29 09:18:09 I #1040 Sched Product Update - Last run time(local) is Thu Aug 28 12:35:00 2008
          2008-08-29 09:18:09 I #1040 Sched
          2008-08-29 09:18:09 I #1040 Sched CNaiSchedule::GetRandomizedDelayMins() : 1
          2008-08-29 09:18:09 i #1040 Sched Next time(local) of task Product Update: 29 August 2008 12:31:00
          2008-08-29 09:18:09 I #1040 Sched All the tasks are successfully loaded from the file
          2008-08-29 09:18:09 i #1040 Sched Scheduler is now running
          2008-08-29 09:18:09 I #1040 Sched <<--CSchedule::Start
          2008-08-29 09:18:09 I #1040 FrmSvc Starting Subsystem <Trusted Connection>
          2008-08-29 09:18:09 I #1040 TrstCon Start
          2008-08-29 09:18:09 I #1040 FrmSvc Service started
          • 2. RE: McAfee Agent 4 "uninstalls" on login
            2nd part:

            2008-08-29 09:33:21 I #1828 FrmSvc User SID is S-1-5-21-2037406089-871956902-1971066577-31570 and SessionID is 0
            2008-08-29 09:33:21 I #1572 Logging StartReadingMessages (\\.\mailslot\{76889C92-A0C0-46e3-A4E1-1D6A5439B8DD}000003d0, 0x7f57, 4)
            2008-08-29 09:33:21 I #1572 Logging - using empty 0
            2008-08-29 09:33:34 I #1004 FrmSvc START cmdline="C:\Program Files\McAfee\Common Framework\FrameworkService.exe"
            2008-08-29 09:33:34 I #1004 FrmSvc Incorrect command line parameters
            2008-08-29 09:33:34 I #1004 FrmSvc END
            2008-08-29 09:34:58 I #1828 UpdEvents Initializing Event Interface
            2008-08-29 09:34:58 I #1828 UpdEvents EpoEventInf Interface: Initialization succeeded.
            2008-08-29 09:34:58 E #1720 RcFile Error trace:
            2008-08-29 09:34:58 E #1720 RcFile [LoadLibrary,C:\Program Files\McAfee\Common Framework\0809\MueRes.dll]->
            2008-08-29 09:34:58 E #1720 RcFile error 126: The specified module could not be found.
            2008-08-29 09:34:58 I #1720 Updater Showdialog
            2008-08-29 09:34:58 I #1720 Uec Waiting for ipc thread to initialize
            2008-08-29 09:34:58 I #1524 ipcchannel Initializing IPC server
            2008-08-29 09:34:58 I #1524 Uec Initialized ipc channel successfully
            2008-08-29 09:34:58 I #1720 Uec Ipc thread initialized successfully
            2008-08-29 09:34:58 I #1720 Uec Invoking Mue with "C:\Program Files\McAfee\Common Framework\McScript_InUse.exe" -script "C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\UpdateMain.McS" -id 4116 -localeid 0809 -parent FRAMEWORK -logfile "C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\DB\McScript" -initiator 0 -ipcid "\\.\pipe\upda01720" -installdir "C:\Program Files\McAfee\Common Framework"
            2008-08-29 09:34:58 I #1828 updater OnDemand update session for initiator EPOAGENT3000 started
            2008-08-29 09:34:59 I #1524 Uec Received ipc data from mue
            2008-08-29 09:34:59 I #1524 Uec Processing progress information
            2008-08-29 09:34:59 i #1524 Updater Checking update packages from repository ePO_ANDROMEDA2.
            2008-08-29 09:34:59 I #1524 Uec Done processing progress information
            2008-08-29 09:34:59 I #1524 Uec Received ipc data from mue
            2008-08-29 09:34:59 I #1524 Uec Processing ShowUpdateDialog information
            2008-08-29 09:34:59 I #1524 Updater Showdialog
            2008-08-29 09:34:59 I #1524 Uec Done processing ShowUpdateDialog information
            2008-08-29 09:34:59 I #1524 Uec Received ipc data from mue
            2008-08-29 09:34:59 I #1524 Uec Processing progress information
            2008-08-29 09:34:59 i #1524 Updater Initializing update...
            2008-08-29 09:34:59 I #1524 Uec Done processing progress information
            2008-08-29 09:34:59 I #1524 Uec Received ipc data from mue
            2008-08-29 09:34:59 I #1524 Uec Processing progress information
            2008-08-29 09:34:59 i #1524 Updater Downloading catalog.z.
            2008-08-29 09:34:59 I #1524 Uec Done processing progress information
            2008-08-29 09:34:59 I #1524 Uec Received ipc data from mue
            2008-08-29 09:34:59 I #1524 Uec Processing progress information
            2008-08-29 09:34:59 i #1524 Updater Verifying catalog.z.
            2008-08-29 09:34:59 I #1524 Uec Done processing progress information
            2008-08-29 09:34:59 I #1524 Uec Received ipc data from mue
            2008-08-29 09:34:59 I #1524 Uec Processing progress information
            2008-08-29 09:34:59 i #1524 Updater Extracting catalog.z.
            2008-08-29 09:34:59 I #1524 Uec Done processing progress information
            2008-08-29 09:34:59 I #1524 Uec Received ipc data from mue
            2008-08-29 09:34:59 I #1524 Uec Processing progress information
            2008-08-29 09:34:59 i #1524 Updater Loading update configuration from: catalog.xml
            2008-08-29 09:34:59 I #1524 Uec Done processing progress information
            2008-08-29 09:35:00 I #1524 Uec Received ipc data from mue
            2008-08-29 09:35:00 I #1524 Uec Processing progress information
            2008-08-29 09:35:00 i #1524 Updater Update list doesn't exist or is empty. Performing one-click update.
            2008-08-29 09:35:00 I #1524 Uec Done processing progress information
            2008-08-29 09:35:00 I #1524 Uec Received ipc data from mue
            2008-08-29 09:35:00 I #1524 Uec Processing progress information
            2008-08-29 09:35:00 i #1524 Updater These updates will be applied if they are in the repository: Engine, DAT, EPOAGENT3000META, VIRUSCAN8600, ENCPTCNT6000.
            2008-08-29 09:35:00 I #1524 Uec Done processing progress information
            2008-08-29 09:35:00 I #1524 Uec Received ipc data from mue
            2008-08-29 09:35:00 I #1524 Uec Processing progress information
            2008-08-29 09:35:00 i #1524 Updater Downloading PkgCatalog.z.
            2008-08-29 09:35:00 I #1524 Uec Done processing progress information
            2008-08-29 09:35:00 I #1524 Uec Received ipc data from mue
            2008-08-29 09:35:00 I #1524 Uec Processing progress information
            2008-08-29 09:35:00 i #1524 Updater Verifying PkgCatalog.z.
            2008-08-29 09:35:00 I #1524 Uec Done processing progress information
            2008-08-29 09:35:00 I #1524 Uec Received ipc data from mue
            2008-08-29 09:35:00 I #1524 Uec Processing progress information
            2008-08-29 09:35:00 i #1524 Updater Extracting PkgCatalog.z.
            2008-08-29 09:35:00 I #1524 Uec Done processing progress information
            2008-08-29 09:35:00 I #1524 Uec Received ipc data from mue
            2008-08-29 09:35:00 I #1524 Uec Processing progress information
            2008-08-29 09:35:00 i #1524 Updater Loading update configuration from: PkgCatalog.xml
            2008-08-29 09:35:00 I #1524 Uec Done processing progress information
            • 3. RE: McAfee Agent 4 "uninstalls" on login
              3rd part:

              2008-08-29 09:35:01 I #1524 Uec Received ipc data from mue
              2008-08-29 09:35:01 I #1524 Uec Processing progress information
              2008-08-29 09:35:01 i #1524 Updater Verifying V2engdet.mcs.
              2008-08-29 09:35:01 I #1524 Uec Done processing progress information
              2008-08-29 09:35:01 I #1524 Uec Received ipc data from mue
              2008-08-29 09:35:01 I #1524 Uec Processing progress information
              2008-08-29 09:35:01 i #1524 Updater Product(s) running the latest Engine.
              2008-08-29 09:35:01 I #1524 Uec Done processing progress information
              2008-08-29 09:35:01 I #1524 Uec Received ipc data from mue
              2008-08-29 09:35:01 I #1524 Uec Processing progress information
              2008-08-29 09:35:01 i #1524 Updater Downloading PkgCatalog.z.
              2008-08-29 09:35:01 I #1524 Uec Done processing progress information
              2008-08-29 09:35:01 I #1524 Uec Received ipc data from mue
              2008-08-29 09:35:01 I #1524 Uec Processing progress information
              2008-08-29 09:35:01 i #1524 Updater Verifying PkgCatalog.z.
              2008-08-29 09:35:01 I #1524 Uec Done processing progress information
              2008-08-29 09:35:01 I #1524 Uec Received ipc data from mue
              2008-08-29 09:35:01 I #1524 Uec Processing progress information
              2008-08-29 09:35:01 i #1524 Updater Extracting PkgCatalog.z.
              2008-08-29 09:35:01 I #1524 Uec Done processing progress information
              2008-08-29 09:35:01 I #1524 Uec Received ipc data from mue
              2008-08-29 09:35:01 I #1524 Uec Processing progress information
              2008-08-29 09:35:01 i #1524 Updater Loading update configuration from: PkgCatalog.xml
              2008-08-29 09:35:01 I #1524 Uec Done processing progress information
              2008-08-29 09:35:02 I #1524 Uec Received ipc data from mue
              2008-08-29 09:35:02 I #1524 Uec Processing progress information
              2008-08-29 09:35:02 i #1524 Updater Verifying V2datdet.mcs.
              2008-08-29 09:35:02 I #1524 Uec Done processing progress information
              2008-08-29 09:35:02 I #1524 Uec Received ipc data from mue
              2008-08-29 09:35:02 I #1524 Uec Processing progress information
              2008-08-29 09:35:02 i #1524 Updater Product(s) running the latest DATs.
              2008-08-29 09:35:02 I #1524 Uec Done processing progress information
              2008-08-29 09:35:02 I #1524 Uec Received ipc data from mue
              2008-08-29 09:35:02 I #1524 Uec Processing progress information
              2008-08-29 09:35:02 i #1524 Updater Verifying AgtMetaDet.McS.
              2008-08-29 09:35:02 I #1524 Uec Done processing progress information
              2008-08-29 09:35:02 I #1524 Uec Received ipc data from mue
              2008-08-29 09:35:02 I #1524 Uec Processing progress information
              2008-08-29 09:35:02 i #1524 Updater Searching available updates for McAfee Agent Plugin.
              2008-08-29 09:35:02 I #1524 Uec Done processing progress information
              2008-08-29 09:35:02 I #1524 Uec Received ipc data from mue
              2008-08-29 09:35:02 I #1524 Uec Processing progress information
              2008-08-29 09:35:02 i #1524 Updater Product(s) running the latest Plugin.
              2008-08-29 09:35:02 I #1524 Uec Done processing progress information
              2008-08-29 09:35:02 I #1524 Uec Received ipc data from mue
              2008-08-29 09:35:02 I #1524 Uec Processing progress information
              2008-08-29 09:35:02 i #1524 Updater Verifying VSE850Det.mcs.
              2008-08-29 09:35:02 I #1524 Uec Done processing progress information
              2008-08-29 09:35:02 I #1524 Uec Received ipc data from mue
              2008-08-29 09:35:02 I #1524 Uec Processing progress information
              2008-08-29 09:35:02 i #1524 Updater Verifying EceptCntDet.mcs.
              2008-08-29 09:35:02 I #1524 Uec Done processing progress information
              2008-08-29 09:35:04 I #1524 Uec Received ipc data from mue
              2008-08-29 09:35:04 I #1524 Uec Processing progress information
              2008-08-29 09:35:04 i #1524 Updater Update Finished
              2008-08-29 09:35:04 I #1524 Uec Done processing progress information
              2008-08-29 09:35:04 I #1524 Uec Received ipc data from mue
              2008-08-29 09:35:04 I #1524 Uec Processing EndUpdateDialog information
              2008-08-29 09:35:05 I #1524 Uec Done processing EndUpdateDialog information
              2008-08-29 09:35:05 I #1524 Uec Received ipc data from mue
              2008-08-29 09:35:05 I #1524 Uec Processing EndUpdateDialog information
              2008-08-29 09:35:05 I #1524 Uec Done processing EndUpdateDialog information
              2008-08-29 09:35:05 I #1524 Uec Received ipc data from mue
              2008-08-29 09:35:05 I #1524 Uec Processing event information
              2008-08-29 09:35:05 I #1524 muemsg Calling HandlePostpone with TaskID: UpdateState: 1
              2008-08-29 09:35:05 I #1524 muemsg Calling m_pUpdateInfoCallback->HandlePostpone
              2008-08-29 09:35:05 I #1524 Updater CMcAfeeUpdate::HandlePostpone() Entered taskid: 0
              2008-08-29 09:35:05 I #1524 Updater Finished calling GetPostponeMins
              2008-08-29 09:35:05 I #1524 Updater CMcAfeeUpdate::HandlePostpone() Exit
              2008-08-29 09:35:05 I #1524 muemsg Finished Calling m_pUpdateInfoCallback->HandlePostpone
              2008-08-29 09:35:05 I #1524 muemsg Finished Calling HandlePostpone
              2008-08-29 09:35:05 I #1524 UpdEvents DeInitializing Event Interface
              2008-08-29 09:35:05 I #1524 UpdEvents EpoEventInf Interface: Deinitialization succeeded.
              2008-08-29 09:35:05 I #1524 muemsg Updater session finish state value =1
              2008-08-29 09:35:05 I #1524 Uec Done processing event information
              2008-08-29 09:35:05 I #1524 Uec Terminating thread
              2008-08-29 09:35:05 I #1720 Uec Terminating ipc channel
              2008-08-29 09:35:05 I #1720 ipcchannel Aborting IPC object connection
              2008-08-29 09:35:05 I #1720 ipcchannel Closing IPC connection
              2008-08-29 09:35:17 I #876 FrmSvc START cmdline="C:\Program Files\McAfee\Common Framework\FrameworkService.exe"
              2008-08-29 09:35:17 I #876 FrmSvc Incorrect command line parameters
              2008-08-29 09:35:17 I #876 FrmSvc END


              I have tried every method of removing/reinstalling the agent that I know of to no avail.