MCSVHOST.EXE crashes in Windows XP randomly

[pgpuneet]

Hi,

I am running Security Center  V 11.0, build 11.0.623,  VirusScan V 15.0 build 15.0.294 dat 6545,  Firewall V 12.0, build 12.0.345 on Windows XP SP3 (auto updated) .

I randomly get the Windows Application Error that McAfee Service Host had crashed message daily (sometime multiple times a day).

Here is the detail from the event log : Faulting application McSvHost.exe, version 2.0.230.0, faulting module ntdll.dll, version 5.1.2600.6055, fault address 0x00011780.

I have already run the McAfee Virtual Technician and it did not find any errors (Session ID 36405373)

Please help.

Thanks !

[JaiPrakash]

Hi,

Kindly let us know some more information of your PC :

• Who is the Manufacturer of your PC ? (HP / Dell / Lenovo / Gateway..)
• How Old is your Computer ?
• Are you using any other security software apart from McAfee on your PC ?
• Are you facing this problem ever since you installed this McAfee or with the recent changes in your PC ?
• Recently, have you made any changes in the PC ?

Also Run the preinstaller tool below to delete McAfee related cookies

http://download.mcafee.com/products/licensed/cust_support_patches/McPreInstall.exe

[iamdavid]

McSvHost.exe crashes on both my HP paviion a350y XpProSP3-32 bit and Toshiba Satellite C655D-S5136 W7Home-64bit. In both computers, the same Unhandled Win32 Exception occurs. This only seems to happen when connected to the Internet and it typically happens after about 45 minutes of connection. This problem has existed for at least several weeks. I have captured some details of the problem on the XP computer.

Shutdown McSvHost due to unhandled Win32 Exception

Unhandled exception at 0x77f67095 in McSvHost.exe: 0xC0000005: Access violation reading location 0x00000004.

After this, msconfig shows SiteAdvisor Service, Personal Firewall, McAfee Services, Virus Scan Announcer, Network Agent, Scanner (not normally running anyway), Proxy Service stopped. McShield, Debug Manager, Core Service, Validation Trust Protection Service still running. Services says that McAfee Services is "started" and the McAfee application (mcagent.exe) reports everything ok, including firewall. sc says that the service name for McAfee Services is mcmscsvc. sc query mcmscsvc shows it running. Task Manager shows McSvHost.exe but taking little or no CPU time. When McAfee Services is restarted in Services, msconfig shows it running again but the other McAfee services all have to be individually restarted.

The McSvHost files are:

01/27/2011  06:28 PM           159,296 McSHIns.dll

01/27/2011  06:27 PM             2,682 McSvcHost.inf

01/27/2011  06:28 PM           214,904 McSvHost.exe

01/27/2011  06:28 PM           209,248 McSvHVer.dll

For both McSvHost.exe and McSvHVer.dll:

Product Version 2,0,0,0  File Version 2.0.230.0 Signed Thursday, January 27, 2011 3:28:13 PM

When the exception occured, I started Visual Studio to examine it. I don't have symbols so I can't tell you where this is in source but it occurs soon after a bunch of NOPs, suggesting that it is near the beginning of a function. In fact, it is so near the beginning that it might not be in your visible code but in function preamble code inserted by the compiler.

77F67082  nop             

77F67083  nop             

77F67084  nop             

77F67085  nop             

77F67086  nop             

77F67087  mov         edi,edi

77F67089  push        ebp 

77F6708A  mov         ebp,esp

77F6708C  mov         edx,dword ptr [ebp+8]

77F6708F  test        edx,edx

77F67091  mov         eax,edx

77F67093  je          77F670BB

77F67095  mov         cx,word ptr [edx] <<<<<<< edx = 4 Ouch!

77F67098  test        cx,cx

77F6709B  je          77F670BB

77F6709D  push        esi 

77F6709E  cmp         cx,5Ch

77F670A2  je          77F670BF

77F670A4  cmp         cx,3Ah

77F670A8  je          77F670BF

77F670AA  cmp         cx,2Fh

77F670AE  je          77F670BF

77F670B0  inc         edx 

77F670B1  inc         edx 

77F670B2  mov         cx,word ptr [edx]

77F670B5  test        cx,cx

77F670B8  jne         77F6709E

77F670BA  pop         esi 

77F670BB  pop         ebp 

77F670BC  ret         4   

77F670BF  lea         ecx,[edx+2]

77F670C2  mov         si,word ptr [ecx]

77F670C5  test        si,si

77F670C8  je          77F670B0

77F670CA  cmp         si,5Ch

77F670CE  je          77F670B0

Message was edited by: iamdavid
Looking at the asm, it is obvious that the caller passed a non-0 but still bad pointer. This is pulled from the activation record by mov edx,dword ptr [ebp+8]. The function checks this for NULL at 77F6708F  test  edx,edx  and 77F67093  je  77F670BB (the intervening move eax, edx doesn't affect the Z flag). Clearly, the function knows that it might be passed a bad pointer but it only checks for NULL, which isn't the only possible bad pointer. on 12/3/11 10:12:47 PM CST

[pgpuneet]

Hi Jai ,

I have run the program to clear the cookies.

I have a Dell Inspiron 6400 purchased in 2005. McAfee is the only security software running on the machine.

There were no recent recent on the PC.

I got the error again today even after cleaning the McAfee Cookies.

[gatemi]

I am receiving the exact same error message at least once per day, and I can assure the McAfee moderators and techs that the issue is NOT related to hardware: I have McAfee licenses for five different computers (all running Windows XP with the latest service packs)—one HP laptop with an AMD dual processor, one Macbook (yes, running Windows XP) with an Intel duo-core processor, one iMac (again, running Windows XP) with an Intel duo-core processor, one Gateway laptop with an AMD processor, and one Compaq laptop with an Intel duo-core processor—and the message pops up on ALL of them. I use Firefox 8.x on all of the computers (never IE), and other than Firefox, no two computers have the exact same software installed (but no cloud software installed, no zuma back-up, no netguard, or any of that stuff). In addition, I've seen postings about this error all over your McAfee forums and elsewhere on the internet, and it seems the error is popping up on a wide variety of makes and models of computers, and the only common denominators seem to be Windows XP and McAfee.

[studiorose]

Netguard is part of the McAfee software.  There's another thread describing how to disable it; I'm at work and don't have time to search for it right now.  But disabling Netguard worked for me; give it a try.

[gatemi]

Okay, thanks, Lisa. The way people were talking here, I just assumed that netguard was a separate application. I'll see if I can figure out how to disable it, though I think it's kind of strange to have to disable part of an application in order to "fix" one of its bugs. And I'm hoping that in doing so I don't open myself up to something that McAfee is supposed to be protecting me from.