Peacekeeper wrote:
My xp test box gets the errors in the event viewer but they do not affect the PC in any way that I see. The OS is new XP home sp3 really has only minimal stuff on it other than norton goback and ghost.
When I got hit (3 times), the Windows "tool" would restore/rename dozens of files (most of them labeled "McAfee").
The PC would then function but I'd get an immediate notification from SC indicating my PC was unprotected. When I then tried to open SC, I'd get a dialog box saying SC was "unable to connect" (paraphrasing) and "sorry for the inconvenience" (direct quote). I would then do a system restore and everything was fine until the next McAfee update.
After the third time this happened (over the course of one and a half weeks) I uninstalled McAfee SC. Everything has been fine since then.
So, in my case, the update bug actually disabled McAfee itself.
I'm no expert, but IMHO the first thing McAfee should do is stop sending automatic updates until the bug is fixed, or, in the alternative, inform its customers on how to turn off the automatic updates.
Anybody there have problem with windows installer, I found out that it was damaged somehow, I instal the newest from microsoft. Today my machine has asked again for my XP install CD and now my windows installer again found damaged. The first time I was discovered it because windows updates not was able to run. Today it was some other software there use the installer.?
Same problems here, on WinXP Pro SP3 with all patches, McAfee AntiVirus Plus 15.0.291 and SecurityCenter 11.0.578, and no other security / malware checking software:
- Had WFP warnings about 2-3 months ago, didn't connect them to McAfee at the time, after (several) uses of WinXP SP2 Boot CD they seem fixed for now.
- Now regularly see "The protected system file xxx could not be verified as valid because Windows File Protection is terminating" in Event Log.
- Sometimes winlogon.exe starts continuously using 30% CPU, with peaks to 50% regularly every few seconds on my dual core PC. It seems disabling Real-Time Scanning for a short while clears that, until next time.
- I have not tracked this closely, but it seems Winlogon.exe is using large amounts of memory and slowly increasing over time, while Task Manager shows it is *writing* a very large number of 'I/O Write Bytes' !?
- Scheduled Scans have become soo slow they are impossible to do. Sometimes it got stuck so badly while trying to scan VMware virtual disk files of several GB size each, I had to hard reset my laptop after unsuccessfully trying for 20 minutes to cancel the scan or initiate a reboot by keyboard. Even when excluding those (see next issue), I have canceled the last attempt after 10 hours, trying to scan 250 GB files on a fast harddisk.
- The file/folder exclusion option of Scheduled Scan as it exists is _unusable_, as I have a large number (30+) of huge encrypted container files in the root directory, and huge VMware virtual disk files in a directory from which several subdirectories contain small files I want to have scanned - but I can either exclude files one by one (for 30+ files??) or exclude the folder and ALL (!!) subfolders with it.
mele63 wrote:
So, in my case, the update bug actually disabled McAfee itself.
I'm no expert, but IMHO the first thing McAfee should do is stop sending automatic updates until the bug is fixed, or, in the alternative, inform its customers on how to turn off the automatic updates.
I had a similar experience several times in the past couple of months. I believe McAfee auto-update is or at least was broken, at least on my system. I had to do a clean unistall and re-install on each occassion. I have disabled automatic updates for some time now and now perform manual updates and have been OK ever since.
Thanks mcafee now has enough Mer logs to keep them happy now to get this sorted out.
Hi all,
This morning I spoke to the guy who is heading up the investigation on this, and here's the status he reported.
He has reviewed some logs and has a couple of more to go; so far nothing conclusive. However, he's also been contacted by a McAfee employee and is going to set up a remote session to that computer to try to determine himself which process is causing this issue.
I'll update this thread when I get more info on what he discovers.
New symptom for me: When the Windows Update was installing tonight, I got a WFP error pop up. The pop ups have only happened for me previously when running SuperAntispyware or Malwarebytes scans unless I disable real time McAfee scanning first. Neither spyware scan runs in real time and until recently neither caused any issues when McAfee real time scanning was on during a spyware scan. I can't be positive but it appeared that tonight's episode happened when the Windows Malicious Software Removal Tool was installing. So for me, it looks like there is a conflict when McAfee's real time scanning is running and when anything is happening with any other spyware/malware application, including a Microsoft update tool.
When this has happened to me, I have ignored the pop up window for the WFP and let the scan finish running. In tonight's situation I let the window up while Microsoft continued to update. When the scans have finished and when tonight's update completed, I left the WFP error box up on the screen and restarted the computer to get rid of the window. I don't want to tell it to replace the file and I don't have the CD that the window is asking for. When it restarts things look ok.
I still get WFP errors showing up in the event log on shut down. But once again, if I disable McAfee real time scanning before shutting the computer down (as a test) I get no errors showing up.
My computer seems to be working just fine and I hope it stays that way.
I've also got a new symptom. It started about two weeks ago. It doesn't happen all the time but about 30%. It happens after a regular McAfee update performed each day. The most significant change is browsing over the Internet. It's painfully slow. A reboot fixes things. I decided to disable the automatic update feature and perform the update manually after I've closed down all applications. I think it has helped but the problem occurred again yesterday. I now reboot after each McAfee update just in case. Again, as I said before I don't mind for now since I'm dumping the PC for a new one.
Update. The lead investigator has connected to one person's system and says
1. The issue didn't reproduce when we booted up the machine. I didn't see any errors coming up however I saw the errors popped up when I ran the SFC utility. It complained of dlls fromWindows Media Player and eHome being affected.
2. The date modified flag of the dlls said to be affected has not changed. Which didn't make much sense.
3. I have copied the files into my machine in any case. I will try to check what changes could have been made.
So I would like to find which process is making changes to the files. One way is to use procmon but these needs to be run when the changes to the files are being done.
I had look into the log files already supplied but those McLogs dont make any mention of the files being affected. I will investigate to find if there is any way to log the files that are being modified by a McAfee process.
He is also asking for event logs from two other machines that have the problem.
I received a direct e-mail from someone with with McAfee Community forums. They wish to know if the problem is still happening (it is) and wish to arrange a call to me about the problem.
Is that a fairly standard practice?
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.
Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership: