Application Error with McShield.exe 5

[dmb11]

Hi,

Several users I support are having application errors associated with McShield.exe and McAfee AV becomes disabled. It either happens on start-up on one of the Windows NT PC's and happens when running a proprietary tax program on another. Is there anything that anybody knows that could cause this conflict/error? Please help! thank you.

 

[Guest_imported]

Did you find out the source of the problem and is there any resolutions? Thanks.

 

[Guest_imported]

I am having the same problem with W2K Pro. Is this a known issue? Only have seen NT4 mentioned in all articles I have read concerning the mcShield.exe error.

 

[ihworthi]

I have been to the McAfee website, but their no "upgraded" web presence has NO search app what-so-ever! I have sent mail to their supposed tech support, but have not heard anything back. I have search the web for info on this exe crash, but all I have found is other people with the same event occuring on their box, and no solutions.

 

[Guest_imported]

What version of NetShield/VirusScan are you using? Do you know what specifically is being done when the crash happens? For instance, is the user trying to access an unusually large file (perhaps the tax software mentioned in the previous article has a large file in it?)?

 

[ihworthi]

read the first post from dmb11 (IS/IT--Manageme) Apr 12, 2001

 

[dmb11]

What is happening in my instance is that the mcshield.exe service is disabled. I then have to enable the service again in the systray. This process repeats itself. I cannot find any specific occurrence that is causing the problem. It happens at different times. McAfee has not responded to my emails for support. Go figure.

 

[Guest_imported]

I am having this occur aswell...It appears to happen when ever a file is scanned. In Win2k it ends up showing the error "mcshield.exe has generated errors....". Because of mcafee's nature to scan a file before opening, this happens as soon as you attempt to do, well, anything. Any suggestions would be great at this point as it appears a reinstall will be the only solution, and thats not good.

 

[boatman]

I'm getting this same error with mcshield. I have several users that have complained about mcshield.exe error and other virus services being disabled when I unable them they just become disabled again. When I checked the application log I noticed that some type of error occurred when it was downloading the update or something. I am running NT 4.0 boxes with sp6. The virus software is configured to autoupdate twice a week and run scans daily. Sometimes the errors are accompanied with Dr. Watson error. Someon tried reinstalling sp 6 and it appeared to work. Also, the virus software I'm running is somewhat outdated. We got a newer version of Mcafee's product and it seemed to correct the problem but in one case that didn't work either. Mcafee product support is very bad. We buy their product and when the darn things bombs out you can't find any information on these cryptic errors and all they want to do is charge you for support. I smell a rat...hmmm....We down load an update from their site, then the software starts spitting out errors and when you go to their site all they want to do is charge you for support????? Sounds like scam to me. You can't get any help on that site and there FAQ section is weak indeed. Why don't they just make a reliable and error-free product? Doesn't the fact that we bought the software entitle us to some support when there updates hack our OS's? Is Norton any better?

 

[Guest_imported]

I am using Win2k, but these errors appear to have started on the addition of dat file 4153. I have tried norton and, there not any better. There is a company called avp or avx that is really good and we use it on our computers at the office.

 

[AVChap]

Jomom,

There's a conflict between the 4153 DATs and the 4.0.50 engine. Check if you've updated the engine.

To the others,

Try sending the event log entry that comes w/ the error to McAfee's technical support. Won't do you too much if you just complain. I've tried their support and they've been helpful enough to solve my problems.

AVChap

 

[Empeethree]

I updated my engine file and it took care of this problem.

found it here

http://www.nai.com/naicommon/download/dats/find.asp

hth
Rob

 

[thmpsnt]

This error is common with Netshield and VirusScan 4.x, and is VERY common with NT and both of those products. If you talk to NAI(McAfee) they will say that to be supported you must be running 4.5x, with latest DATs, and 4140 scan engine. Currently there is work at NAI to realease th 4150 scan engine. Also it is requested by NAI that you are also running the 6a Service Pack if running NT. Even with all this taken care of...you still may recieve the error (I support 1000+ NT servers and at least 1% end up with the error). It may go away...but still might(probably) come back. If you are running Terminal Server or Citrix Metaframe, you will encounter more problems... and if you are installing to a IIS active server...you've got a 70-30 chance of keeping McAfee running let alone installed at all. Another good idea is to make sure the BIOS is up-to-date, and you have a clean build running. Unfortunately I have to support Netshield for Netware and NT... if you have the power...research using something else.

 

[boatman]

Well I spoke too soon. Upgrading the virus software from version 4.0.3a to version 4.5.0 did not help. We are still getting the errors. Workstations with both versions have a scan engine of 4.1.40 and definition tables 4154. I even unistalled Mcaffee(rebooted), cleaned the registry with regvac (rebooted), reinstalled mcaffee (rebooted) and then installed sp6a. I am still getting the Mcshield.exe error. 30% of the workstation on my network are getting this error still. I have wrote mcafee's technical help and they have not replied. If anyone knows a solution any help would be much appreciated.

Regards,

boatman

 

[jguillory]

I have updated all of our workstations to the newest engine and all errors have vanished..

 

[Guest_imported]

i have isolated all variables to replicate a problem:
pull a new dell optiplex gx115 out of a carton.
boot up to the pre-installed windows 2000 pro sp1.
install virusscan v4.5.
then launched ie5 and went to

http://www.yahoo....

the windows dialoge box for program errors does read that 'mcshield.exe has generated errors and will be closed by windows'.
after i re-enable virusscan and point ie to

http://www.yahoo.com

then windows repeats the same.
EXCUSE ME but this is unacceptable.

 

[Guest_imported]

Are you installing with custom or default settings? If custom, what?

Are you performing any updates before attempting this?

What does your McLogEvent in the application log say? Can you be more specific about the error information?

Have you tried the same with v.4.5.1?

 

[booty]

Guys,

I had the same problems, NAI have a Hot Fix for some of these issues, however you have to be nice to one of their support staff so that they will e-mail the patch to you.

Hope this helps.

See ReadMe.Txt extract below.


Release Notes for McAfee VirusScan v4.5.0
Anti-Virus Software for Windows 95, Windows 98,
Windows NT Workstation v4.0, and
Windows 2000 Professional
HotFix P
(c) 2001 Networks Associates Technology, Inc.
All Rights Reserved.


================================================

HotFix Release: May 18, 2001

This HotFix was developed and tested with:
- VirusScan: 4.5.0

Make sure you have installed this version before
using this HotFix.

================================================


Thank you for using VirusScan software.
This file contains important information
regarding this release. McAfee strongly
recommends that you read the entire document.


________________________________________________
WHAT'S IN THIS FILE

- About This HotFix
- Purpose
- Resolved Issues
- Files Included With This HotFix
- Installation
- Installation Requirements
- Preparing to Install This Hotfix - Installation Steps
- Removing This HotFix
- Contacting McAfee and Network Associates
- Copyright and Trademark Attributions
- Trademarks
- License Agreement


IMPORTANT NOTE:

McAfee requires that you install
Service Pack 1 for VirusScan software
before you install this HotFix. You can
download the Service Pack from the McAfee
web site at:

http://www.mcafeeb2b.com/naicommon/download/upgrade/login.asp

You must supply your customer grant number
or user name and password to access this
site.


________________________________________________
ABOUT THIS HOTFIX

## PURPOSE ##

- This HotFix resolves an issue that causes
MCSHIELD.EXE to time out when scanning files
across the network with Network Drive Scanning
enabled.

- This HotFix resolves an issue that causes a
General Protection Fault error on computers
that have VirusScan software installed, but do
not have floppy drives connected to them. In
most instances, these computers are laptop
models that have swappable floppy disk drives,
but this error could also occur on computers
that simply do not have a floppy drive
connected.


## RESOLVED ISSUES ##

- On Windows 2000 Professional desktops with
Network drive scanning enabled, accessing a
file on a NetWare 4.11 server with the
Microsoft NetWare redirector results in
McShield timing out.

On Windows 2000 Professional desktops, and
Windows NT Workstation v4.0 with Network
drive scanning enabled, accesing files on
NetWare servers with NetWare Client 4.8 results
in McShield timing out.

- If you have a computer that has VirusScan
software installed, but does not have a floppy
drive connected to it, and you try to select,
double-click or otherwise use that floppy drive
from within Windows, the VShield scanner will
look for viruses on the nonexistent floppy
drive.

The VShield scanner does so because the BIOS
for most computers indicates the presence of a
floppy disk even where none exists. The
operating system, in turn, assumes that what
the BIOS tells it is true. The VShield scanner,
finally, assumes that what the operating system
tells it is true. The scanner, therefore, tries
to examine the boot sector for the floppy disk
that it assumes is in the floppy drive.

After a point, however, the VShield scanner
times out and issues a General Protection Fault
(GPF) error. The built-in time-out period exists
to prevent very large files from hanging the
scanner as it tries to process them. A
particular type of denial-of-service attack
uses such files to disable anti-virus software.

This HotFix includes a new MCSHIELD.EXE file
that ignores the established VShield time-out
period when the scanner examines floppy drives.
The scanner will, therefore, continue to try
scanning the non-existent floppy disk until the
operating system times out and resumes control,
and will not issue a GPF error.

This GPF error can also occur if you have a
floppy disk window open as you shut down your
computer, then you remove the floppy disk or
disconnect the drive. In that instance, the
operating system assumes that the drive is still
present. The system tries to open the drive
again, which causes the VShield scanner to try
to examine the disk for viruses.


## FILES INCLUDED WITH THIS HOTFIX ##

This HotFix consists of a package called
VSC450P.ZIP, which contains the following
files:

MCSHIELD.EXE =
VShield scanner service for Windows NT
4.0 Workstation and Windows 2000
Professional systems
HOTFIXP.TXT =
This text file
PACKING.LST =
Packing list for HotFix files


________________________________________________
- INSTALLATION

## INSTALLATION REQUIREMENTS ##

To use this HotFix, you must have VirusScan v4.5
anti-virus software installed on the computer you
intend to update with the HotFix software. McAfee
also requires that you install VirusScan Service
Pack 1 before you install this HotFix.

IMPORTANT:
If you do not install the Service Pack first,
you might overwrite the files included with
this HotFix when you next install the Service
Pack.

This HotFix will not work with earlier
VirusScan versions.


## PREPARING TO INSTALL THIS HOTFIX ##

1. To install this HotFix, first create a
temporary directory on your hard drive, then
extract the HotFix files to that temporary
directory.

2. You might also want to make a backup copy of
the MCSHIELD.EXE file you have already
installed on your system. Copy this file to
a different directory, or rename the file
with a different extension.

________________________________________________
- INSTALLATION STEPS

To summarize, installing this HotFix requires you
to disable your VShield scanner, then copy the
new MCSHIELD.EXE file from the temporary
directory you created in step 1 of "Preparing to
Install This HotFix" to the Network Associates
Common Files directory. Complete steps for this
procedure appear below.

NOTE:
You can install this HotFix on systems that run
Windows NT 4.0 Workstation or Windows 2000
Professional without restarting your computer,
provided that your computer has not just
crashed with the error described in "Resolved
Issues." If your computer has just crashed,
you must first restart it, then follow the steps
shown below.

To disable VirusScan software and copy the new
file to its correct location, follow these steps:

1. Click "Start," point to "Settings," then
choose "Control Panel."

2. Locate, then double-click the VirusScan
control panel icon to open it.

3. Click "Stop" at the top of the Service
property page.

This stops all VirusScan operations,
including the VShield scanner and any scan
operations in progress.

4. Copy the new MCSHIELD.EXE file from the
temporary directory you created to the
Network Associates Common Files directory.
If you installed your VirusScan software in
its default location, that directory is:

C:\Program Files\Common Files\Network Associates\McShield

If you left the name of the original file
intact, allow the new file to overwrite the
original MCSHIELD.EXE file.

5. Return to the VirusScan control panel. The
button you clicked earlier should now read
"Start." Click the button again to restart all
VirusScan operations.

The VShield scanner will now use the new
MCSHIELD.EXE file.


## REMOVING THIS HOTFIX ##

To remove this HotFix from your computer, follow
the steps that appear in "Installation Steps"
earlier in this file. This time, however, copy
the older version of the MCSHIELD.EXE file that
you backed up into the Network Associates Common
Files directory. "Preparing to Install This HotFix"
describes this step.


________________________________________________
CONTACTING MCAFEE AND NETWORK ASSOCIATES

Technical Support

http://knowledge.nai.com

Product Documentation Issues
tvd_documentation@nai.com


McAfee Beta Site

http://www.mcafeeb2b.com/beta/

AVERT Anti-Virus Research Site

http://www.mcafeeb2b.com/avert

Download Site

http://www.mcafeeb2b.com/naicommon/download/

DAT File Updates

http://www.mcafeeb2b.com/naicommon/download/dats/find.asp

Product Upgrades

http://www.mcafeeb2b.com/naicommon/download/upgrade/login.asp

Valid grant number required.
Contact Network Associates Customer
Service


On-Site Training Information

http://www.mcafeeb2b.com/services/mcafee-training/default.asp

Finding a Reseller

http://www.mcafeeb2b.com/naicommon/partners/tsp-seek/intro.asp

Network Associates Customer Service
US, Canada, and Latin America toll-free:
Phone: +1-888-VIRUS NO or +1-888-847-8766
Monday - Friday, 8 a.m. - 8 p.m.,
Central Time

E-mail: services_corporate_division@nai.com
Web:

http://www.nai.com

http://www.mcafeeb2b.com

For additional information on contacting
Network Associates and McAfee -- including
toll-free numbers for other geographic areas --
see the documentation that accompanied your
original product release.


________________________________________________
COPYRIGHT AND TRADEMARK ATTRIBUTIONS

(c) 2001 Networks Associates Technology,
Inc. All Rights Reserved. No part of this
publication may be reproduced, transmitted,
transcribed, stored in a retrieval system, or
translated into any language in any form or by
any means without the written permission of
Networks Associates Technology, Inc., or its
suppliers or affiliate companies. To obtain this
permission, write to the attention of the
Network Associates legal department at: 3965
Freedom Circle, Santa Clara, California 95054,
or call +1-972-308-9960.


## TRADEMARKS ##

Active Security, ActiveHelp, ActiveShield,
AntiVirus Anyware and design, Bomb Shelter,
Building a World of Trust, Certified Network
Expert, Clean-Up, CleanUp Wizard, Cloaking,
CNX, CNX Certification Certified Network Expert
and design, CyberCop, CyberMedia, CyberMedia
UnInstaller, Data Security Letter and design,
Design (logo), Design (Rabbit with hat), design
(stylized N), Disk Minder, Distributed Sniffer
System, Distributed Sniffer System (in Katakana),
Dr Solomon's, Dr Solomon's label, Enterprise
SecureCast, EZ SetUp, First Aid, ForceField,
Gauntlet, GMT, GroupShield, Guard Dog, HelpDesk,
HomeGuard, Hunter, I C Expert, ISDN TEL/SCOPE,
LAN Administration Architecture and design,
LANGuru, LANGuru (in Katakana), LANWords, Leading
Help Desk Technology, LM1, M and design, Magic
Solutions, Magic University, MagicSpy, MagicTree,
MagicWord, McAfee Associates, McAfee, McAfee
(in Katakana), McAfee and design, NetStalker,
MoneyMagic, More Power To You, MultiMedia
Cloaking, myCIO.com, myCIO.com design (CIO
design), myCIO.com Your Chief Internet Officer
& design, NAI & design, Net Tools, Net Tools
(in Katakana), NetCrypto, NetOctopus, NetRoom,
NetScan, NetShield, NetStalker, Network
Associates, Network General, Network Uptime!,
NetXray, NotesGuard, Nuts & Bolts, Oil Change,
PC Medic, PC Medic 97, PCNotary, PGP, PGP
(Pretty Good Privacy), PocketScope, PowerLogin,
PowerTelNet, Pretty Good Privacy, PrimeSupport,
Recoverkey, Recoverkey - International,
Registry Wizard, ReportMagic, RingFence, Router
PM, SalesMagic, SecureCast, Service Level Manager,
ServiceMagic, SmartDesk, Sniffer, Sniffer (in
Hangul), SniffMaster, SniffMaster (in Hangul),
SniffMaster (in Katakana), SniffNet, Stalker,
Stalker (stylized), Statistical Information
Retrieval (SIR), SupportMagic, TeleSniffer, TIS,
TMACH, TMEG, TNV, TVD, TNS, TSD, Total Network
Security, Total Network Visibility, Total Service
Desk, Total Virus Defense, Trusted MACH, Trusted
Mail, UnInstaller, Virex, Virus Forum, ViruScan,
VirusScan, VShield, WebScan, WebShield, WebSniffer,
WebStalker, WebWall, Who's Watching Your Network,
WinGauge, Your E-Business Defender, ZAC 2000, Zip
Manager are registered trademarks of Network
Associates, Inc. and/or its affiliates in the US
and/or other countries. All other registered and
unregistered trademarks in this document are the
sole property of their respective owners.


## LICENSE AGREEMENT ##

NOTICE TO ALL USERS: FOR THE SPECIFIC TERMS OF
YOUR LICENSE TO USE THE SOFTWARE THAT THIS
DOCUMENTATION DESCRIBES, CONSULT THE LICENSE.TXT
OR OTHER LICENSE DOCUMENT THAT ACCOMPANIES YOUR
SOFTWARE, EITHER AS A TEXT FILE OR AS PART OF
THE SOFTWARE PACKAGING. IF YOU DO NOT AGREE TO
ALL OF THE TERMS SET FORTH THEREIN, DO NOT
INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY
RETURN THE PRODUCT TO THE PLACE OF PURCHASE FOR
A FULL REFUND.

 

[SWmiller]

My vShield would disable anytime I would open IE and I would get a Mcshield.exe error. Then I took Ratio's advice and downloaded the latest engine at:

http://www.nai.com/naicommon/download/dats/find.asp

and now my problem seems resolved.

 

[Empeethree]

Someone actually took my advice? The end is near.. =)