We all see things in the Event Viewer that could, if we were so inclined, allow us to get really worried. personally I ignore it completely unless something starts malfunctioning or annoying popups keep appearing. Is this the case here?
Well, since you ask, there are several annoyances which started at around that time but may have nothing to do with WFP. Mostly I regard the WFP messages as merely informational, but I keep an eye on the 64001 messages because the reason for WFP attempting to replace a protected system file is not at all obvious.
The main reason for the previous post was to point out the apparent connection between those messages appearing and a McAfee program (as opposed to DAT) update in November.
One other thing which does perhaps connect with the WFP messages is unexpected behaviour from mcsvhost. mcsvhost frequently crashes after the PC comes out of standby or hibernation, but that's okay because it just auto-restarts after a short interval. This too has only started in the past month or so, after that update.
There is also odd behaviour from mfevtps (McAfee Process Validation Service) : straight after I downloaded an optional Microsoft Update (KB931125) which updated the list of root certificates, mfevtps went into overdrive and took all the cpu for about ten minutes and at the same time initiated a massive amount of network i/o. This was not a McAfee auto-update because that function is disabled.
Oh, and there have also been a few BSODs. Nothing to worry about, I investigated each one and took remedial action where required.
I'm not too fussed about Event Viewer messages except where they indicate either a continuing problem or a critical one. Much more interesting is the Dr Watson log (drwtsn32.log) which has the state dumps and stack back traces for the mcsvhost failure - although it helps to know a bit of Assembler if you want to look at those.
I hear you. Well we'll we say what is said on our call on Monday. By 'is this case here' I meant is McAfee causing problems other than warnings in Event Viewer.Message was edited by: Ex_Brit on 15/12/12 12:44:54 EST PM
I am running Windows XP MCE SP3, and Malwarebytes (free) is installed. Ever since I upgraded in early December 2012 from McAfee Security Center version 10 to version 11 (currently 11.6 build 11.6.443), I receive messages saying "Files that are required for Windows to run properly have been replaced by unrecognised versions....". Sometimes it lists several DLLs in the event viewer, but it is often EHTRAY. I did not have this problem prior to the upgrade to V11 Security Center. I used MSCONFIG to disable EHTRAY (access to media center) and received no WFP errors for over a week. Even though I received a McAfee Security Center software update and obviously DAT file updates. As soon as I used MSCONFIG and re enabled EHTRAY I'm back to the WFP errors. I've tried working with McAfee technical support who told me to talk to Microsoft! I believe as shown here by this community update and the one from approximately a year ago, this is a McAfee problem and needs to be addressed. I think I saw in this update where there may be a fix?? If you do a Google on "McAfee EHTRAY", there is an entry in the Microsoft Community with almost the same problem dated December 2012 but it is not resolved. Any help to resolve this issue would be appreciated, thanks. Nigel.
Best call Technical Support or use their online chat, either way it's free, linked under Useful Links at the top of this page.
But you also might want to check for malware first, run Stinger and Malwarebytes Free, both in the last link in my signature below, The reason I suggest that is that ehtray the process belongs to Windows Media Center, but ehtray.exe can be an infection.
Also make sure that Windows is totally up to date using the option in Windows Update settings to use Microsoft Updates to search for updates for all of Windows.Message was edited by: Ex_Brit on 28/01/13 8:29:07 EST PM
I ran Stinger- no issues. I ran MalwareBytes Quick Scan - no issues. Windows Update is turned on to load updates automatically and is up to date. I looked at Microsoft Update options but did not see the specific setting you mentioned. Although as I said all Windows products are being updated. If I still need to find that option can you point me to it in detail?
Tech Support said Microsoft problem! I noticed your tag is Ex_Brit., me too from Bristol now in USA. Any other suggestions would be appreciated. Thanks Nigel.
Forgot you are running XP and updates are done at an actual website for that OS so go here: http://update.microsoft.com/microsoftupdate/v6/default.aspx?ln=en and if it simply display then you are already getting that option, it it asks you to install something then go ahead and do that and then you will in future get your updates from Microsoft Updates. I found that making a desktop shortcut to it helped.
If your problems continue I would call Technical Support - it's free and available via Useful Links at the top of this page.Message was edited by: Ex_Brit on 31/01/13 3:59:28 EST PM
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.
Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership: