Skip Ribbon Commands
Skip to main content

McAfee 8.7i "Could not contact Filter Driver", On Access Scan Disabled

 

Andrew Walman

06/11/2008

McAfee have recently released VirusScan Enterprise 8.7i, with various performance improvements over 8.5i. So we rolled it out using ePolicy Orchestrator, and then noticed some of the servers had the On-Access Scan disabled. Further inverstigation revealed the upgrade had been successful on these servers, but then the service was struggling to start reporting the following error in the application event log:
 
Event Type: Error
Event Source: McLogEvent
Event Category: None
Event ID: 5004
Date:  06/11/2008
Time:  10:17:22
User:  NT AUTHORITY\SYSTEM
Computer: MACHINENAME
Description:
Could not contact Filter Driver.
 Error = 0x7d1 : The specified driver is invalid.
 
After trawling through the McAfee help forums, it turns out a lot of people are experiencing the same problem (another great example of product testing from McAfee) and it's to do with the system volume being a dynamic disk, which is a more common situation on servers - but it could equally affect workstations. The fix is to update the registry on the affected server, or wait till patch 1 (apparently due in February) before deploying 8.7i to anything with a dynamic disk.
 
Incidentally, if you've already deployed 8.7i and found this problem, retrograding to 8.5i doesn't seem to fix it - you'll need the registry update or patch.
 
Details of the registry fix are here - essentialy you'll be updating the path to mfeapfk, mfeavfk, and mfebopk which live under HKLM\SYSTEM\CurrentControlSet\Services\, with the full path to the driver - e.g. c:\windows\system32\drivers\mfeapfk.sys. You'll need to do this once 8.7i has finished installing, then simply start the McAfee McShield Service again - no reboot required.
 
As always, take care when editing the registry - http://support.microsoft.com/kb/256986/EN-US/
 
UPDATE 8/12/08
We've since observed this same error on Windows XP without dynamic disks, after a full disk check was performed. The same registry edit fixed the problem
 
UPDATE 10/12/08
The latest round of Windows updates has caused the problem to reoccur on servers that previously were fixed by the registry edit - slightly different error messages this time, and it was only fixed with a reinstall of Enterprise v8.7 and reapplying the registry fix above. Error 1:
 
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date:  09/12/2008
Time:  21:31:45
User:  N/A
Computer: MACHINENAME
Description:
The McAfee Inc. mfehidk service failed to start due to the following error:
The filename, directory name, or volume label syntax is incorrect.
 
Error 2:
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date:  09/12/2008
Time:  21:31:45
User:  N/A
Computer: MACHINENAME
Description:
The McAfee Validation Trust Protection Service service depends on the McAfee Inc. mfehidk service which failed to start because of the following error:
The filename, directory name, or volume label syntax is incorrect.


 
 

 About us

Fuse Collaboration Services is a Cloud Solution Provider and Microsoft Gold Partner specialising in delivering SharePoint, Skype for Business, and Azure cloud-based solutions. Based in Northampton, UK.

Microsoft Gold Partner Logo showing 5 competencies

Read more

 Latest Tweets

 Latest Blog

 

 

Better Mobile 4G and the Portable Office3089<p class="lead">​​<img class="img-responsive float-right" src="/ourblog/Blog%20Site%20Images/OneDrive-for-Business-App.png" alt="OneDrive for Business App" style="max-width&#58;300px;margin&#58;5px;" />Transport for London’s (TfL) plans to roll out 4G across the London Undergound network are continuing apace, with the <a href="http&#58;//www.cityam.com/287267/tfl-moves-step-closer-offering-4g-mobile-coverage-tube-2019" target="_blank">recent news</a> that this will likely include the new Elizabeth Line (aka CrossRail) and the planned C​rossRail 2 and Northern Line extension projects.</p><p>Suppliers and interested parties have had until July 6th to submit a selection questionnaire, which will then be evaluated before a more thorough tender goes out in early August.</p><p>City AM reports that companies will be competing to construct a commercial fibre optic network and the provision of a public WiFi service in specified TfL stations. The plan Is for the first stations to get connected during 2019, taking the capital one step closer to being a fully mobile working environment.​</p><p>WiFi already exists in some Tube stations, as it does on large parts of the train network across the country – even if the actual internet speeds vary widely depending on whereabouts you are!</p><p>Both TfL and the train companies will be heavily promoting the virtues of this type of connectivity for both leisure and work use, and it is popular here in the East Midlands, where we have a mixture of commuters heading into either London or Birmingham and companies who have to travel to see their clients.</p><p>But in the same way as nothing can beat the quality of a film that is already downloaded to your device, you need to make sure you have the processes and protocols in place for your mobile working to make sure you do not lose​ work unnecessarily. After all, there is nothing more frustrating than concentrating hard for an hour, only to see your work disappear because the saving process has not worked properly!</p><div class="well well-lg bg-color4 lead"><p>Here are Fuse’s top tips for your mobile working&#58;</p><ol><li>Make sure you have OneDrive syncing in place, so that when you save your document to your device it will automatically update onto your online OneDrive folder as soon as you are back online, thereby ensuring that your company work remains up-to-date<br></li><li>Do not get too reliant on having internet connectivity when you are on the move. Access to online resources may not be available for the duration of your whole journey, and even if your device is connected to the on-train WiFi the actual internet speeds will vary depending on whereabouts you are, or if you are in a tunnel<br></li><li>Have processes and checklists in place – even if they are just your own individual way of working, not official company policy – to ensure that you always download what you need onto your machine before you travel<br></li></ol></div>​ <p class="lead">Here at Fuse we believe that having the wherewithal to work effectively on the move is an integral part of the modern office. This includes OneDrive syncing being set up on all your machines, working with you to develop robust working practices for all your staff, and proactively making sure that your IT provision works to meet your needs, not the other way around.</p><div class="well well-lg"><p class="lead">Get in touch to find out how we can make sure that you have the great IT provision your organisation deserves! Call 01604 797979 or <a href="/_layouts/15/FIXUPREDIRECT.ASPX?WebId=4fc45909-2b6d-48b9-bcf9-a446e9d472d6&amp;TermSetId=c98895cd-d37f-4406-9cff-5480b4f829b6&amp;TermId=218eb0be-10f6-490a-82a7-a7fd47c8de90">send us an enquiry​​​</a></p>​ </div> | Chris Wearmouth | 693A30232E777C6675736563735C632E776561726D6F757468 i:0#.w|fusecs\c.wearmouth18/07/2018 23:00:002018-07-18T23:00:00ZAs better 4G rolls out across the nation how are you going to make your office truly mobile?As better 4G rolls out across the nation how are you going to make your office truly mobile?16/10/2018 23:15:466261htmlFalseaspx

 Contact us

Our address
12 Brookfield, Duncan Close
Moulton Park, Northampton
NN3 6WL
P: +44(0)1604 797979
Contact Us