×
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
exbrit
MVP
MVP
Message 31 of 91

Re: Conflict with recent "Total Protection" update.

Very odd.  I use nVidia and have all the OS's in a multi-boot here, XP, Vista 7 and 8 and they all work fine.

julesp
Contributor
Message 32 of 91

Re: Conflict with recent "Total Protection" update.

Hi all,

I'm a newbie on here (although have had McAfee Security Centre installed on Dell PC since 2006), and am having the same WFP errors coming up daily as others have posted on this and other threads (texmex101) etc. They appear sometime after boot-up, but not on shutdown.

WFPs started following McAfee update install & reboot (v 11.6.435) from 27.11.12.

I have Dell Dimension 5150, XP MCE (2002) + SP3, Pentium4 3.0Ghz, 2.5Gb RAM, ATI Radion 256Mb graphics. All Windows etc are updated with latest.

McAfee Products:

SC v. 11.6.443 updated 12.12.12 (but was 11.6.435 when WFP errors started)

VS v. 15.6.238 DAT 6924

PF v. 12.6.186

SA v. 3.5.0.229

AS v. 12.6.144

PC v. 13.6.126

QC&S v. 11.6.164

(No quarantined system or other files except 1 low-risk Trojan in Oct 2012)

I also do not use and have never installed/run Malwarebytes, Superantispyware or other Registry cleaner software, so it is not a conflict with these programs causing these WFPs, and although I have ATI Radeon graphics, I have had not any display/monitorvideo driver issues.

All XP and SP software was pre-installed or downloaded, so I have no discs to reload any WFP system .dlls.

Sample WFP Error:

Event Type: Warning
Event Source: Windows File Protection
Event Category: None
Event ID: 64008
Date:  08/12/2012
Time:  10:00:12
User:  N/A
Computer: D7P1V32J
Description:


The protected system file c:\windows\system32\kbdus.dll could not be verified as valid because Windows File Protection is terminating. Use the SFC utility to verify the integrity of the file at a later time.

I did have a non-working DVD RW drive at the time, and thought this might have contributed, but have since installed a working DVD and still same WFPs arising, so not connected to this.

I am now considering going back to a Restore Point on 26.11.12 before WFps started, but will then have to uninstall McAfee, run MCPR and reinstall, but I have no confidence that WFPs will not re-occur again afterwards. I have not contacted Tech Support as they usually end up advising doing exactly what I have stated above.

I also had the widespread internet connection problems caused last summer following a McAfee update, did all the above which did not resolve issue, and as with others, issue just disappeared with another McAfee update.

Seems to me McAfee update has resulted in these widespread WFP errors, although I did find a related item on MS Support, Article ID: 904677 - Last Review: November 15, 2012 - Revision: 6.0 (link below) which states cause as "This behavior may occur because of an infection by VX2 malicious program variants"

http://support.microsoft.com/kb/904677

Any thoughts?

exbrit
MVP
MVP
Message 33 of 91

Re: Conflict with recent "Total Protection" update.

System Restore may simply cause the cycle to begin all over again so I wouldn't try that for now.   If you are totally up to date with Microsoft updates then I suggest contacting Technical Support.  It's free by phone or online chat and available via Useful Links at the top of this page.

moldyjacket
Former Member
Message 34 of 91

Re: Conflict with recent "Total Protection" update.

I have an open ticket with McAfee Technical Support on this same issue (993614793 waiting response from level 2), but I’m posting now to encourage others experiencing this problem to do the same and aid in the resolution. I suspect most having this trouble are not associating it with McAfee because of the WFP messages in the System log or don’t even know where to begin diagnosing it.

Here’s a question that might help narrow things down: is anyone with digitally signed Microsoft WHQL certified drivers experiencing this problem too? My Windows XP (Pro SP3 32-bit) ATI display drivers are not (legacy product, Radeon X1300 under final driver release) and never will be as many older NVIDIA based cards are too.

Of course I’ve used this card and drivers for years without any issues at all until the recent software update (McAfee AV Plus has been provided by my ISP since the beginning of this year, Symantec before that). McAfee developers are well aware of using the undocumented WFP features: http://blogs.mcafee.com/mcafee-labs/wfp-hack-redefined

Either we all have malware McAfee is not catching, or McAfee is currently performing as malware.

Update: tier 2 support just called. Very hard to understand the accent (India I believe), but supposedly there is a new software update to be pushed soon he believes will fix the problem.

Message was edited by: moldyjacket on 12/13/12 6:20:52 PM CST
rabbit2
Contributor
Message 35 of 91

Re: Conflict with recent "Total Protection" update.

Hi julesp,

I think it is unlikely that the problem is related to the particular virus mentioned in the Microsoft article because the article is old and that virus would be well known now. That's not to say another virus is not involved but I think this is also unlikely because of the similar (identical?) problem that we had with McAfee last summer and which mysteriously disappeared with a new McAfee release. Also I could make this problem come on with McAfee installed, off when uninstalled, on when installed etc etc. I would say definitely McAfee related.

WFP errors in themselves are not a disaster if the machine continues to run ok - although obviously the system files protection mechanism is compromised and some would argue that this exposes your machine to risk. Those of us who have suffered the terrible screen displays have mostly taken some action, but maybe you can live with your symptoms until there's a fix.

If you do decide to restore and then reload McAfee you'll be back where you started because the fresh online McAfee build will be their latest offering - not a pre-problem build - until they create a fix, that is, and you won't know what build you'll be getting because they don't tell us. If restore does work for you - and this is not guaranteed because some of us have found that McAfee does not run properly after a restore - you could stay on the old McAfee build for a while and only accept updates when the blogs report the problem has gone. Run Malewarebytes every week while your in this less-than-perfect state and bolt down your h/w firewall and McAfee to full stealth. Unless you do strange peer to peer connections or bit torrents, full stealth should not be a problem. Uninstall McAfee using their FAQ to ensure that your license is freed up ready for re-use.

Finally, don't hold your breath whilst waiting for a fix.

Message was edited by: rabbit2 on 13/12/12 19:04:30 CST
julesp
Contributor
Message 36 of 91

Re: Conflict with recent "Total Protection" update.

Thanks for all your responses, guys.

Having seen all the issues, especially ones others are going through, and knowing the amount of time I've already spent on this and the extra hours involved in uninstalling, cleaning and re-installing McAfee (not the first time, and no doubt not the last!), and as I'm not having particular OS issues other than WFP messages, I'm sitting tight with current McAfee build for now.

If things go wrong on PC, I may change my mind and Restore, but if not and the WFPs disappear (the last one was 13/12/12 at 14:28 - and was the only one yesterday............ssshhh!) then I'll update here.

Unfortunately, i'm paid up with McAfee till May 2014, otherwise may have decided to go back to free AVG & Zonealarm, etc which I always used to use before Dell.

Also, not holding my breath.

rajeshk4u
Former Member
Message 37 of 91

Re: Conflict with recent "Total Protection" update.

I m supposed to have McAfee give me a call back. They want to try a couple of things.

moldyjacket: I did consider if it was a Virus.... Why did Windows File Protection flag up the keyboard??

Support did n't want people to change things on their machines, as needed working system to test their solutions....  So I have avoided tinkering with my PC.

rajeshk4u
Former Member
Message 38 of 91

Re: Conflict with recent "Total Protection" update.

Another point, yes, when the PC is re-booted this is when it goes to 4 bit graphics mode.

When re-install ATI drivers, it does warm me they are unsigned etc... CONTINUE INSTALLATION. ATI drivers have always been like that.

More drivers are effected by Windows File Protection (see Event Viewer), however, it is the Graphics driver which causing issues...

moldyjacket
Former Member
Message 39 of 91

Re: Conflict with recent "Total Protection" update.

Rajeshk4u, I get those too: The protected system file c:\windows\system32\kbdus.dll could not be verified as valid because Windows File Protection is terminating. I’ve seen tons of them for virtually every system driver; it indicates a full SFC scan was in progress at system shutdown. This in and of itself is not causing our major problem, but it does indicate SFC is being engaged at the wrong time. My personal theory is that McAfee is actively interfacing and using the “features” of the WPF system, but not correctly which is causing our tribulations.

But malware or not, McAfee owes its customers official open and direct information throughout this process. Here’s a recent Imperva report on the subject: http://www.imperva.com/docs/HII_Assessing_the_Effectiveness_of_Antivirus_Solutions.pdf.

The key is quick resolution and open communication enabling customer to take compromised security mitigation steps if necessary, particularly financial.

exbrit
MVP
MVP
Message 40 of 91

Re: Conflict with recent "Total Protection" update.

I'm bringing this up again at our next conference call with McAfee on Monday afternoon to ask what's going on and when a cure is likely.   I don't think McAfee is capable of initiating a System File Check however (sfc /scannow), but something is maybe doing that.   All I can suggest right now is to check that Windows is absolutely up to date in all aspects, even parts you may not use.  For instance people often forego IE updates because they use Firefox or Chrome or whatever, that's a big mistake as many processes use it behind the scenes, McAfee included.   Keep drivers up to date along with firmware for optical drives etc.

How Many Badges Can You Collect?
Ready for a little competition? Members like you are earning badges and unlocking perks for their helpful answers. Are you? Click here to find out.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community