Skip Ribbon Commands
Skip to main content

McAfee 8.7i "Could not contact Filter Driver", On Access Scan Disabled

 

Andrew Walman

06/11/2008

McAfee have recently released VirusScan Enterprise 8.7i, with various performance improvements over 8.5i. So we rolled it out using ePolicy Orchestrator, and then noticed some of the servers had the On-Access Scan disabled. Further inverstigation revealed the upgrade had been successful on these servers, but then the service was struggling to start reporting the following error in the application event log:
 
Event Type: Error
Event Source: McLogEvent
Event Category: None
Event ID: 5004
Date:  06/11/2008
Time:  10:17:22
User:  NT AUTHORITY\SYSTEM
Computer: MACHINENAME
Description:
Could not contact Filter Driver.
 Error = 0x7d1 : The specified driver is invalid.
 
After trawling through the McAfee help forums, it turns out a lot of people are experiencing the same problem (another great example of product testing from McAfee) and it's to do with the system volume being a dynamic disk, which is a more common situation on servers - but it could equally affect workstations. The fix is to update the registry on the affected server, or wait till patch 1 (apparently due in February) before deploying 8.7i to anything with a dynamic disk.
 
Incidentally, if you've already deployed 8.7i and found this problem, retrograding to 8.5i doesn't seem to fix it - you'll need the registry update or patch.
 
Details of the registry fix are here - essentialy you'll be updating the path to mfeapfk, mfeavfk, and mfebopk which live under HKLM\SYSTEM\CurrentControlSet\Services\, with the full path to the driver - e.g. c:\windows\system32\drivers\mfeapfk.sys. You'll need to do this once 8.7i has finished installing, then simply start the McAfee McShield Service again - no reboot required.
 
As always, take care when editing the registry - http://support.microsoft.com/kb/256986/EN-US/
 
UPDATE 8/12/08
We've since observed this same error on Windows XP without dynamic disks, after a full disk check was performed. The same registry edit fixed the problem
 
UPDATE 10/12/08
The latest round of Windows updates has caused the problem to reoccur on servers that previously were fixed by the registry edit - slightly different error messages this time, and it was only fixed with a reinstall of Enterprise v8.7 and reapplying the registry fix above. Error 1:
 
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date:  09/12/2008
Time:  21:31:45
User:  N/A
Computer: MACHINENAME
Description:
The McAfee Inc. mfehidk service failed to start due to the following error:
The filename, directory name, or volume label syntax is incorrect.
 
Error 2:
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date:  09/12/2008
Time:  21:31:45
User:  N/A
Computer: MACHINENAME
Description:
The McAfee Validation Trust Protection Service service depends on the McAfee Inc. mfehidk service which failed to start because of the following error:
The filename, directory name, or volume label syntax is incorrect.


 
 

 About us

Fuse Collaboration Services is a Cloud Solution Provider and Microsoft Gold Partner specialising in delivering SharePoint, Skype for Business, and Azure cloud-based solutions. Based in Northampton, UK.

Microsoft Gold Partner Logo showing 5 competencies

Read more

 Latest Tweets

 Latest Blog

 

 

Skype for Business and so much more…195<p class="lead"> Yes? Then this is an important read!</p><p>We all know (hopefully!) <a href="/_layouts/15/FIXUPREDIRECT.ASPX?WebId=4fc45909-2b6d-48b9-bcf9-a446e9d472d6&amp;TermSetId=c98895cd-d37f-4406-9cff-5480b4f829b6&amp;TermId=4cd8262c-9c67-4bcb-8f13-65e8ffa6299a">what Skype for Business is</a> but what is different about the version we can offer? </p><p>Fuse has been working ​with the UK's leading Skype for Business provider since they began operating four years ago. Working alongside our partners you will receive the usual unified communications inherent in Skype for Business but further to this you will have access to call centre solutions, call monitoring, call analytics and 24-hour support. The support is available globally and frees up IT staff allowing them to increase their productivity and availability. </p><p>Further to the above features you will have access to an online portal which will allow you to quickly commission and decommission users, configure/reconfigure call groups, manage users and telephone numbers, configure interactive voice response(IVR), call routing, on hold marketing and call reporting.</p><p>Working with the solution we offer, you will be given the benefit of not having a long-term contract tying you in to a lengthy subscription. You can down scale or upscale monthly, giving you the control of your budgets. The flexible scale up/down in line with organisational changes is an important bonus to many customers. </p><p>The monthly price works out at half the price of competitors with call bundles and next to no downtime. </p><p> <strong>The benefits are&#58;</strong></p><ul><li>Reduced annual costs as one monthly cost includes unlimited free outbound calls to UK and line telephone numbers. International call packages are available. Free calls to UK mobile numbers available as an add on</li><li>Flexible working - inbound and outbound business calls and online meetings from anywhere with an internet connection</li><li>Encrypted and secure communication<br></li><li>End to End Fully Managed Service</li><li>24 hr, 7 days a week dedicated support; online support and contact centre</li><li>Online Visual Management and Analytics Portal</li><li>Global solution, from reslient datacenters with multiple providers</li><li>Audio and video conference facility for up to 250 participants – even if they're not on Skype for Business. All they need is a phone or internet connection.</li><li>Fixed monthly fee per user that is payable on a monthly subscription</li><li>Integration with Outlook/SharePoint to show availability/presence (on premise or O365)</li><li>Increases productivity - Collaboration between teams is simplified due to the ability to share files etc.</li><li>Instant messaging with dancing emojis!</li></ul><hr />​​ <div class="well well-lg"><p class="lead">​To book a demo contact Fuse Collaboration on 01604 797979 or email fuse@fusecollaboration.com </p></div>​​ <p>Fuse Collaboration is a Microsoft accredited Gold Partner, License and Systems Specialist</p>​ ​l.ozier@fusecollaboration.com | Louise Ozier | 693A30232E777C6675736563735C6C2E6F7A696572 i:0#.w|fusecs\l.ozier26/06/2017 23:00:002017-06-26T23:00:00ZDoes your business make lots of phone calls?29/06/2017 15:18:4654https://www.fusecollaboration.com/ourblog/Pages/Forms/AllItems.aspxhtmlFalseaspx

 Contact us

Our address
12-14 Brookfield, Duncan Close
Moulton Park, Northampton
NN3 6WL
P: +44(0)1604 797979
Contact Us