Skip Ribbon Commands
Skip to main content

McAfee 8.7i "Could not contact Filter Driver", On Access Scan Disabled

 

Andrew Walman

06/11/2008

McAfee have recently released VirusScan Enterprise 8.7i, with various performance improvements over 8.5i. So we rolled it out using ePolicy Orchestrator, and then noticed some of the servers had the On-Access Scan disabled. Further inverstigation revealed the upgrade had been successful on these servers, but then the service was struggling to start reporting the following error in the application event log:
 
Event Type: Error
Event Source: McLogEvent
Event Category: None
Event ID: 5004
Date:  06/11/2008
Time:  10:17:22
User:  NT AUTHORITY\SYSTEM
Computer: MACHINENAME
Description:
Could not contact Filter Driver.
 Error = 0x7d1 : The specified driver is invalid.
 
After trawling through the McAfee help forums, it turns out a lot of people are experiencing the same problem (another great example of product testing from McAfee) and it's to do with the system volume being a dynamic disk, which is a more common situation on servers - but it could equally affect workstations. The fix is to update the registry on the affected server, or wait till patch 1 (apparently due in February) before deploying 8.7i to anything with a dynamic disk.
 
Incidentally, if you've already deployed 8.7i and found this problem, retrograding to 8.5i doesn't seem to fix it - you'll need the registry update or patch.
 
Details of the registry fix are here - essentialy you'll be updating the path to mfeapfk, mfeavfk, and mfebopk which live under HKLM\SYSTEM\CurrentControlSet\Services\, with the full path to the driver - e.g. c:\windows\system32\drivers\mfeapfk.sys. You'll need to do this once 8.7i has finished installing, then simply start the McAfee McShield Service again - no reboot required.
 
As always, take care when editing the registry - http://support.microsoft.com/kb/256986/EN-US/
 
UPDATE 8/12/08
We've since observed this same error on Windows XP without dynamic disks, after a full disk check was performed. The same registry edit fixed the problem
 
UPDATE 10/12/08
The latest round of Windows updates has caused the problem to reoccur on servers that previously were fixed by the registry edit - slightly different error messages this time, and it was only fixed with a reinstall of Enterprise v8.7 and reapplying the registry fix above. Error 1:
 
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date:  09/12/2008
Time:  21:31:45
User:  N/A
Computer: MACHINENAME
Description:
The McAfee Inc. mfehidk service failed to start due to the following error:
The filename, directory name, or volume label syntax is incorrect.
 
Error 2:
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date:  09/12/2008
Time:  21:31:45
User:  N/A
Computer: MACHINENAME
Description:
The McAfee Validation Trust Protection Service service depends on the McAfee Inc. mfehidk service which failed to start because of the following error:
The filename, directory name, or volume label syntax is incorrect.


 
 

 About us

Fuse Collaboration Services is a Cloud Solution Provider and Microsoft Gold Partner specialising in delivering SharePoint, Skype for Business, and Azure cloud-based solutions. Based in Northampton, UK.

Microsoft Gold Partner Logo showing 5 competencies

Read more

 Latest Tweets

 Latest Blog

 

 

SharePoint - The Production Hub of Every Efficient Modern Office923<p class="lead">Monty Python's quest for the holy grail took King Arthur up hill and down dale, through woods and across rivers, and past challenges a-plenty.</p><p class="lead">Every business has its own quest for as high a level of productivity as possible, and fortunately you don't have to overcome the Black Knight to reach your ultimate goal.</p><p>But it is a journey worth taking, as according to some research undertaken by Nucleus Research in 2016 nearly 5 percent of GDP in the United States was lost in productivity costs as employees searched for content within their company's systems, with a further 3.6 percent of GDP spent on re-creating content that had already been lost.</p><p>For a company that turns over £10 million per annum this is equivalent to £460,000 of needless productivity costs simply searching through archives and £360,000 of content re-creation costs.</p><p>This has been recognised by some of the world's most outstanding businesses, with 85 percent of Fortune 500 companies already using SharePoint, Microsoft's collaboration software, to underpin their continued success.</p><p>But you don't have to have turnover in the billions of pounds to reap the benefits of a relatively small investment in SharePoint.</p><p>SharePoint gives you a clear and concise entry point both into your archives and current content, and allows you to share and work on many types of documents within your working groups in real time. No waiting for one person to finish editing before you make amendments, no laborious wading through folders upon folders of content from times past, just simple and easy processes wherever you are in the world and whatever device you are using.</p><p>SharePoint is an integral part of our operations here at Fuse, which means that we know just how to make the most of its impressive capabilities. We also know that there is no such thing as an 'off the shelf' solution to any organisation, and we take the time to work with you to find out exactly what you want and how we can help you achieve it.</p><p>Proactive businesses are successful businesses, so get ahead of the curve with <a href="/_layouts/15/FIXUPREDIRECT.ASPX?WebId=4fc45909-2b6d-48b9-bcf9-a446e9d472d6&amp;TermSetId=c98895cd-d37f-4406-9cff-5480b4f829b6&amp;TermId=5abcf6c4-2a4a-45fa-af70-4468462b3732">SharePoint​​</a>.</p><hr /><div class="well"><p> <strong>Jargon busting</strong><br><em>SharePoint</em>&#58; Microsoft's collaboration software that lets your working groups share documents, information, news and apps in a secure and easily accessible place. SharePoint is available both as a stand-alone product and as part of Office 365, and is the hub of any successful modern office</p><p> <strong>How it works</strong><br>SQL databases (configuration, services and content) deliver content to web clients through both a web browser as well as tightly-integrated Office applications and the Windows operating system</p><p>The base platform provides authentication, workflow, content, search and data processing services</p><p>APIs and service end points allow the platform to be extended through development, while the interface look-and-feel can be customised through common web development tools.​</p></div>​ | Chris Wearmouth | 693A30232E777C6675736563735C632E776561726D6F757468 i:0#.w|fusecs\c.wearmouth04/04/2018 23:00:002018-04-04T23:00:00ZSharePoint reduces time spent searching for and duplicating content24/04/2018 02:36:241286htmlFalseaspx

 Contact us

Our address
12 Brookfield, Duncan Close
Moulton Park, Northampton
NN3 6WL
P: +44(0)1604 797979
Contact Us