Firewall Core Services not starting

[GauBan]

I've recently installed McAfee Internet Security Suite 2010 onto my PC and UMPC. My UMPC is working fine with the firewall however my PC is a different matter. After installing McAfee was working fine (All McAfee services were workng). After rebooting McAfee reports that everything is fine however I was able to access other systems on my network (Could still access internet) nor able to log access my PC from another system on my network. Trying the make changes to the firewall settings show as changed bu revert when rebooted (The changes are only noted by McAfee GUI and not firewall service).

After investigation I found that the problem was caused by the McAfee Firewall Core Services (MFEFIRE.EXE) being unable to start. Checking the event logs it seems that one of the McAfee Legacy drivers thinks that MFEFIRE.EXE or part of it's libary files is corruppted or infected. The logs  The also logs show Core Services trying to start, start and then stop.

I've uninstalled McAfee and cleared all McAfee files and registry entries (inclusing Legacy Drivers thanks to Mini PE reg editor). Reinstalled and the same thing happened again.

I've used msconfig to try working through the services and apps that start when I book my system (Apart from McAfee ones) and this still has not helped.

I've run McAfee Virtual Technician and the only issue found was that the Firewall Core Services wasn't started. Reports fixed but the service was still not running (Event logs shows that it tried but stopped again straight after)

Before install Windows Firewall and Microsoft Defender was running. After install Windows Firewall is disabled. I've checked for viruses, trojans and malware using both Defender and McAfee and nothing was found.

Microsoft Windows XP Pro SP3

McAfee Internet Security Suite 2010 3 user licence (Installed using CD with files gathered from internet)

Can anyone help?

[GauBan]

Now that I am home I can post up a little more info.

Even without the firewall installed the McAfee Firewall Core Service is set as a service on a PC.

Info about service is:

Service Name: mfefire

Display Name: McAfee Firewall Core Service

Description: Provides firewall services to McAfee products

Path to executable: "C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe"

Startup type: Automatic

Service status: Stopped

Log on as: Local System Account

Dependencies:

This service depends on the follwoing system components

McAfee Validation Trust Protection Service

     McAfee Inc. mfehidk

The follwoing system components depend on this service

McAfee Network Agent

McAfee Proxy Service

When the service trys to start I get the following log entries all in the space of a second (The events are posted in accedinding time order)

----- Entry 1 -----

Type: Warning

Source: mfehidk

Category: (256)

Event: 514

User: N/A

Description: Process **\MFEFIRE.EXE pid (3016) contained unsigned or corrupted code and was blocked from performing a privileged operation with a McAfee driver.

----------------------

----- Entry 2 -----

Type: Information

Source: Service Control Manager

Category: None

Event: 7035

User: My username

Description: The McAfee Firewall Core Service service was successfully sent a start control.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------------

----- Entry 3 -----

Type: Information

Source: Service Control Manager

Category: None

Event: 7036

User: N/A

Description: The McAfee Firewall Core Service service entered the running state.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------------

----- Entry 4 -----

Type: Information

Source: Service Control Manager

Category: None

Event: 7036

User: N/A

Description: The McAfee Firewall Core Service service entered the stopped state.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------------

Again any help someone can offer would be great. I've been using McAfee for years and want to keep using it. I don't trust the firewall for XP too much as it only monitors inbout connections.

[user_135799]

What is the type of internet connection ?

check the date and time

if it is wrong, correct it and restart the computer

If mcafee is uninstalled (else uninstall mcafee using the link http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe  )

http://www.microsoft.com/downloads/details.aspx?familyid=889482FC-5F56-4A38-B838-DE776FD4138C&displa...

check the mcafee program options given and you can uninstall (Note Usefull to remove older versions of mcafee)

restart the computer

then follow the below :

Manual steps to run Chkdsk from My Computer or Windows Explorer

1. Double-click My Computer, and then right-click the hard disk that you want to check.
2. Click Properties, and then click Tools.
3. Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed,
4. Use one of the following procedures:
   • To run Chkdsk in read-only mode, click Start.
   • To repair errors without scanning the volume for bad sectors, select the Automatically fix file system errors check box, and then click Start.
   • To repair errors, locate bad sectors, and recover readable information, select the Scan for and attempt recovery of bad sectors check box, and then click Start.
   Note If one or more of the files on the hard disk are open, you will receive the following message:
   The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?
   Click Yes to schedule the disk check, and then restart your computer to start the disk check.

The following table lists the exit codes that Chkdsk reports after it has finished:

Exit code	Description
0	No errors were found.
1	Errors were found and fixed.
2	Disk cleanup, such as garbage collection, was performed, or cleanup was not performed because /f was not specified.
3	Could not check the disk, errors could not be fixed, or errors were not fixed because /f was not specified.

Restart the computer once again, if you still face the problem

Click on start->run->sfc /scannow, it will ask you to insert the OS CD, insert the OS CD, it will perform the task, once it is complete restart the computer.

   If you still face the issue, It is appreciable to let us know

[The_Narc]

Hello GauBan,

The first thing I'm going to tell you is join the club... Since I uninstalled/installed using all the available tools and removed old registry entries I get an error similar to...

Type: Warning

Source: mfehidk

Category: (256)

Event: 514

User: N/A

Description: Process **\MFEFIRE.EXE pid (3016) contained unsigned or corrupted code and was blocked from performing a privileged operation with a McAfee driver.

Instead of MFEFIRE.EXE in my case is MCSHIELD.EXE. This happens every time I open the main window, check for updates, scan files, etc., always with event #516 and different pid #. Check my unsolved discussion here:

http://community.mcafee.com/message/115174#115174

BTW I've been also a faithful McAfee user for more than 15 years, always loved it because I've been 100% safe and never had any virus, malware or similar. Hope someone will read this ASAP and give us an answer.

Cheers,

The_Narc

Edited on 2/18/10 11:23:07 AM CST

[GauBan]

Cheers for the post.

Yeah I've alreay been through those actions. The system had a full chkdsk and found no errors. This just a couple of days before installing the new McAfee.

I've been contacted by a member of the McAfee support team who are investigating these issues. So far they say that the issue is caused by the McAfee Validation Module.

By turning off Access Protection and forcing the start of the mfehidk.sys via a registry change managed to start the the service. I'll just have to wait and see what they find.

[GauBan]

Well all I can recommend it to try what was recommend in the post above yours to see if that solves your issues.

If all fails try contacting McAfee support direct or send a private message to any of the McAfee support engineers who use the forum.

[The_Narc]

Hello,

Can you tell me what you did to fix the events? I mean what registry tweaks you did. I've already tried those solutions, my system is not the problem it is McAfee 2010. I'd like to ask you to add my issues to yours because they are very similar and might help somebody else because apparently it is very difficult to get some decent help from McAfee's Customer Service.

Thx & Cheers,

The_Narc

[jjvanka]

My (similar) problem occurred after the recent upgrade/update -- http://community.mcafee.com/thread/23982

JJ