Application Error with McShield.exe 5

[dmb11]

Hi,

Several users I support are having application errors associated with McShield.exe and McAfee AV becomes disabled. It either happens on start-up on one of the Windows NT PC's and happens when running a proprietary tax program on another. Is there anything that anybody knows that could cause this conflict/error? Please help! thank you.

 

[FatesWebb]

it is over 2 years old... and you can confirm that by disabling the scan files on shutdown and then shutting down.... which that feature is not really needed. as it only scans for boot sector viruses, which these days are rare, and also the normal scanner scans for them anyways. js error; 67 on line; 36 of signature.class

 

[FatesWebb]

just to clarify that the over 2 years old part is in reguards to this thread, and the rest was in reply to the floppys on shutdown thread js error; 67 on line; 36 of signature.class

 

[Guest_imported]

We've had the same problem on our end. The sdat file wasn't getting rolled out correctly with locked computers and got corrupted, producing the mcShield.exe error. If you copy the newest Superdat file to your C:\ and run it, it wil say current version already installed. But if you type C:\sdat4207.exe /f into your Run... prompt it forces the install and fixes the problem.

 

[Guest_imported]

I'm running VirusScan NT 4.0.3a and just used the Automatic DAT update to go to definition 4.0.4209 and guess what?
"Application Error witrh MCSHIELD.exe" led me to this thread.
My thanks to previous correspondents and especially the one from OPTICz.
By following the example and downloading sdat4209.exe and running it with the /f parameter I have eliminated the problem.
This solution incidentally took my engine to 4.1.60 and I'm guessing that had I done the product upgrade before the DAT update I may have avoided these problems.

 

[AVChap]

Opticz,

Look at the SuperDAT.log file and check the error messages. Should give you an idea what happened. The /F parameter forces SDAT to ignore any errors/messages and continue replacing the engine files.

K1W1guest,

Suggest you upgrade the version as well to 4.5.1 SP1 (yes, this version works on NT workstation). It may seem that the latest DAT file is not compatible with 4.0.3a (unverified). Best you check with your McAfee rep.

Hope this helps.

AVChap

PS: Can we now please end this thread? If you have another issue related to this, start a new thread. Thanks.

 

[Bhelliom]

Search your registry for "Nai Filter"
(This is a virtual device mcafee installs)
In our LAN we tried to locate the problem and found out, that on machines with 2 instances of "Nai filter" the problems with VirusScan remain. On machines with only one "Nai Filter" entry in the registry the software works fine. The problem is, that only "System" (NT/2K) is allowed to delete the second entry. Even with administrator rights you aren't able to delete this key.
Maybe this is the way...

 

[Guest_imported]

I have Windows NT Server 4.0.

I had to uninstall Mcaffee online because according to your technical support, you do not support Win NT any longer.

I have even gone to the trouble of removing the files step by step from the registry.

However, i still get two errors when i boot up my server.

"unable to start the application, class files could not be loaded."

it gives this message twice every time i boot up.

I am stumped?

Do you have any suggestions.

p.s. why did you prompt me to upgrade to the newest version of virus scan on line, which i did, at which point it no longer supports Win NT. This left me unprotected for several weeks, all the while looking like i was protected.

Best regards.

 

[AVChap]

Use NetShield for NT, which is the appropriate version. Not VirusScan.

AVChap

 

[Guest_imported]

Hi,
There was a request to confirm whether or not the problem with mcshield crashing if there was no floppy drive installed. I have screen prints of this problem witht the 35000ms timeout due to \device\floppy0 being scanned. I can e-mail anyone the screen print of this from event viewer if they really need it.

Here's the Event Viewer log:

Date: 8/1/02 Event ID: 5051
Time 11:31:25 AM Source: McLogEvent
User NT AUTHORITY\SYSTEM Type: Error
Computer: ADDMES72 Category: None

Description:
A thread in process C:\PROGRA~1\COMMON~1\NETWOR~1\McShield\Mcshield.exe took longer than 35000 ms to complete a request.
The process will be terminated. Thread id : 153 (0x99)
Thread address : 0x77f6793f
Thread message :

Build Sep 20 2000 15:10:30 / 8.52
Object being scanned = \Device\Floppy0 ( @ 25011 (10006,10010,25016,10006))

 

[AVChap]

This was fixed with both SP1 for NetShield 4.5 and VirusScan 4.5 and 4.51. All you need to do is to apply them.

AVChap

 

[Guest_imported]

'***** Begin Quote *****

AVChap (TechnicalUser) Aug 20, 2001
Jomom,

There's a conflict between the 4153 DATs and the 4.0.50 engine. Check if you've updated the engine.

To the others,

Try sending the event log entry that comes w/ the error to McAfee's technical support. Won't do you too much if you just complain. I've tried their support and they've been helpful enough to solve my problems.

AVChap

'***** End Quote *****

UPGRADE dont 'update' as the update only gets the new .dat files and UPGRADE gets the new engine AND .dat files.

I had same problems:
StartUp = Crash
Scan properties = Crash
Running (Random) = Crash
Fixed it by:
Upgrading from server at work
You can fix it by:
Upgrading from VirusScan console, Network Associates or a reliable website.

 

[Guest_imported]

Here you go boys....I found it on the mcafee web site...currently I don't have the hotfix and haven't tested the reg hacks.......hopfully it should work...good luck!

SolutionID: nai18383 Printer-Friendly Page
Problem Description:
Error: "Event ID: 5051" Source: "McLogEvent"

Event ID 5051

Error in the Event log

Dr. Watson error in McShield.exe referencing memory address 77fxxxxx (e.g. Thread address : 0x77f6771f)

Description: A thread in process C:\network associates\NetShield 2000\mcshield.exe took longer than _____ms to complete a request. The process will be terminated. Thread id : XXX Thread address : 0x77fxxxxx Thread message : Object being scanned = \Device\Harddisk0\Partition4\officedocs\example.doc ( @ 10010 (24011,10006,10010,24016))

A thread in process C:\network associates\NetShield 2000\mcshield.exe took longer than _____ms to complete a request.

The process will be terminated. Thread id : XXX

Thread address : 0x77fxxxxx

Thread message : Object being scanned = \Device\Harddisk0\Partition4\officedocs\example.doc ( @ 10010 (24011,10006,10010,24016))

Dr. Watson

Resolving a standard file timeout in McShield

Problem Environment:
McAfee NetShield 4.5

Microsoft Windows NT

Microsoft Windows 2000

HotFix

Cause of this problem:
The McShield component does not have enough time to scan a given file.


Solution:
Network Associates recommends applying the HotFix Rollup (HFR) for NetShield 4.5 to resolve the issue. Contact your Network Associates Support representative to request the HotFix Rollup.See NAI21128: "HotFix Rollup for NetShield 4.5".

A series of steps must be taken to resolve standard file timeout issues. These steps should be taken in the following order: 1. Identify the issue. Check the event log description (Object being scanned =) to determine which file McShield timed out on. If a specific file is referenced, continue with step 3. 2. If McShield timed out on a hard drive partition or a CDRom drive, see Primus article NAI18427 "Resolving a hard drive partition or CDRom timeout in McShield" for the resolution. 3. Make note of the file the timeout occurred on. If it is an archive or compressed file, see Primus article NAI7440: Changing the "ScanArchive Timeout" to a higher value for information on McShield timeouts involving archive or compressed files. If it is not a compressed or archived file, proceed with step 4.Note: Executable files (EXE) can sometimes be self-extracting compressed files. 4. Increase the timeout settings to the half-maximum values. (To do this, the following can be copied and pasted into a .REG file, then launched to make the changes):NOTE: You should use NOTEPAD when creating the .REG file. When saving the file, be sure to use a .REG extension, since in order to import the created file it must have a .REG extension.REGEDIT4[HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\On Access Scanner\McShield\Configuration]"ScannerThreadTimeout"=dword:000249f0"ScannerThreadTimeoutEx"=dword:0000b98cNote:000249f0 hex = 150000 decimal0000b98c hex = 47500 decimalSee also NAI3692: Dr. Watson error or General Protection Fault scanning very large files 5. In some cases, this may still not be enough. You may have large numbers of large files that have to be scanned no matter the performance cost. To increase the timeout values even further, apply the QA-Tested Maximum timeout values:REGEDIT4[HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\On Access Scanner\McShield\Configuration]"ScannerThreadTimeout"=dword:0004a768"ScannerThreadTimeoutEx"=dword:00017318Note:0004a768 = 305000 decimal00017318 = 95000 decimalSee also NAI3692: Dr. Watson error or General Protection Fault scanning very large files

IMPORTANT: Before Network Associates Support will release a HotFix, it will be necessary to confirm that you are experiencing an issue that the requested HotFix addresses. Once you contact Technical Support, a technician will assist you by opening a case and obtaining the necessary information in order to receive the HotFix. To see the complete list of HotFixes available for McAfee products, click here: NAI10000: "HotFix List for McAfee Products"NOTE: There are times when corrections need to be made to HotFixes, so HotFixes cannot be publicly posted. You will need to contact Technical Support via e-mail or phone support, depending on your support contract, in order to receive the HotFix. If you do not have a support contract, you will need to contact your sales person to receive the HotFix.If you have a KnowledgeCenter support contract (or better), contact Technical Support via e-mail by visiting

http://support.mcafeeb2b.com,

choose the appropriate product from the list on the left and then choose 'E-Mail Technical Support' from either the center of the screen or from the navigation box on the right side of the window. Be sure to include a reference to this solution in order to receive the correct HotFix.To contact a sales person, visit one of the following pages:· North America:

http://www.mcafeeb2b.com/aboutmcafeeb2b/contactus/worldwide-sales.asp

· Canada:

http://www.mcafeeb2b.com/naicommon/aboutnai/contact/offices-canada.asp

· Latin America & Caribbean:

http://www.mcafeeb2b.com/naicommon/aboutnai/contact/offices-latin-amer.asp

· Europe, Middle East & Africa:

http://www.mcafeeb2b.com/naicommon/aboutnai/contact/offices-europe.asp

· Asia & Pacific:

http://www.mcafeeb2b.com/naicommon/aboutnai/contact/offices-asia-pacific.asp

Note: While we read with interest all comments, we will not be able to respond to questions submitted here. If you have questions and need answers, please email us using the technical support email submission. Did this solution document help you solve your problem? Yes, this document helped. This solution did not apply to my issue. No, this document did not help. Do you have any additional comments?
This solution is provided as information only. Network Associates cannot make any guarantee, either explicit or implied, as to its accuracy or relevance to specific system installations/configurations. Although Network Associates believes the information provided in this solution to be accurate at the time of writing, we reserve the right to modify, update, retract or otherwise change the information contained within for any reason, and without notice. All liability for use of the information presented here remains with the user.Any trademarks referenced in this document are the property of their respective owners. Consult your product manuals for complete trademark information. ©2002, Networks Associates Technology, Inc. All Rights Reserved. Privacy Policy Statement.Product Divisions: McAfee Security, Sniffer Technologies, Magic Solutions

 

[Guest_imported]

Sorry about the formatting above!!! heh....didn't realize.

 

[Guest_imported]

and for all you arcserve 2000 users.......this was what our problem really was.


Problem Description:
Error: "A thread in process C:\Program Files\Network Associates\NetShield
2000\Mcshield.exe took longer than 35000 ms to complete a request.
The process will be terminated."

Event ID 5051

McShield times out scanning small .DOC and .XLS files

McShield timeout error when scanning small .DOC and .XLS files


Problem Environment:
McAfee NetShield 4.5 SP1

Computer Associates ARCserve 2000

Microsoft Windows NT


Cause of this problem:
Issue was caused by the ARCserve Openfile Agent post-Service Pack 3 Hotfix.


Changes affecting this problem:
ARCserve 2000 post-Service Pack 3 Hofix was applied on the server.


Solution:
Remove the post-Service Pack 3 Hotfix for ARCserve Openfile Agent and re-apply Service Pack 3 for ARCserve 2000.

 

[Guest_imported]

Regarding the message posted by jamie d (Visitor) on Dec 27, 2001

(Help! Big corp has about 700 out of 2000 Windows NT 4 PC's now upgraded from 4.03 to 4.5.1. About 40-50 workstations are now blue screening every few days. They all die on 1 of 2 errors
1} "PAGE_FAULT_IN_NONPAGED_AREA"
2} "PFN_LIST_CORRUPT&quot

We are experiencing the exactc same problem on 8000 NT 4 PC's does anyone have any suggestions - Isn't it stange that McAfee claims they have never heard of this?

 

[AVChap]

jamesm2002,

Regarding the errors mentioned, these are NOT McAfee VS problems. These are documented issues on the NT OS. Refer to these links for info:

1. PAGE_FAULT_IN_NONPAGED_AREA:

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q222635&

2. PFN_LIST_CORRUPT:

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q291806&

Hope this helps.

AVChap

PS: That's the reason why McAfee claims they've never heard of this.

 

[Crundy]

I had a problem where McAfee was just disabling itself after about 5 seconds each time I tried to start it. I installed the latest dat, superdat, and all the hotfixes with no joy. I found (as mentioned above) a page on McAfee's website detailing how to set the timeout intervals to fix this problem, and it worked!!

I've made a registry file to do this automatically if anyone wants it. You can download it from

http://www.cryptpad.com/fix_mcafee.reg

It alters the timeout intervals to "Half maximum" (as they put it on the McAfee website). I made it with W2k server, so if you're using NT or something like that, you'll have to change the first line in the file.

Hope that helps. C:\DOS:>
C:\DOS:>RUN
RUN DOS RUN!!

 

[UknowBJ]

To Crundy --- Please post your version/sp level

 

[Crundy]

Netshield for Windows NT and Windows 2000 4.5
Virus definitions: 4.0.4219
Scan Engine: 4.1.60 C:\DOS:>
C:\DOS:>RUN
RUN DOS RUN!!

 

[Guest_imported]

Re: McAfee Causing Blue Screens

The STOP 0x50 and 0x24 dumps pointed to the Naifiltr.sys driver being the cause

PAGE_FAULT_IN_NONPAGED_AREA BugCheck 50, {f000ff6b, 0, 0, 2} NAIFILTR.SYS

Relaxing the McAfee settings seems to have eliminated the McAfee Trap 50 blue screen; however, the 0x24 continues to occur.

According to M/S Windbg: Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM). Another common cause is the installation of a faulty system service. >>> Antivirus software can also trigger this error, as can a corrupted NTFS volume. <<<

Does anyone have additional information? McAfee denies, Microsoft insists.