Loading...

Knowledge Center


Error 1920: Service McShield failed to start (when installing VirusScan Enterprise 8.7i)
Technical Articles ID:  KB59863
Last Modified:  02/18/2013
Rated:


Environment

McAfee VirusScan Enterprise (VSE) 8.7i (Release To World)

 

Problem

You see the following error when you install VSE 8.7i:

Error 1920, service McShield failed to start

VSEInst.log records the following error:

MSI (s) (7C:2C) [09:45:48:788]: Executing op: ProgressTotal(Total=16,Type=1,ByteEquivalent=1300000)
MSI (s) (7C:2C) [09:45:48:788]: Executing op: ServiceControl(,Name=McAfeeEngineService,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:45:50:163]: Executing op: ServiceControl(,Name=McTaskManager,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:45:50:772]: Executing op: ServiceControl(,Name=McAfeeFramework,Action=1,Wait=0,)
MSI (s) (7C:2C) [09:45:50:772]: Executing op: ServiceControl(,Name=McTaskManager,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:45:51:272]: Executing op: ServiceControl(,Name=McTaskManager,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:45:51:772]: Executing op: ServiceControl(,Name=McTaskManager,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:45:52:272]: Executing op: ServiceControl(,Name=McShield,Action=1,Wait=1,)
MSI (s) (7C:2C) [09:47:43:241]: Product: McAfee VirusScan Enterprise -- Error 1920.Service McAfee McShield (McShield) failed to start. Verify that you have sufficient privileges to start system services.
Error 1920.Service McAfee McShield (McShield) failed to start. Verify that you have sufficient privileges to start system services.
MSI (s) (7C:2C) [09:47:43:241]: User policy value 'DisableRollback' is 0
MSI (s) (7C:2C) [09:47:43:241]: Machine policy value 'DisableRollback' is 0

Windows Application Event Log records the following errors:

Event Type: Error
Event Source: MsiInstaller
Event Category: None
Event ID: 11920
User: NT AUTHORITY\SYSTEM
Description: Product: McAfee VirusScan Enterprise -- Error 1920.Service McAfee McShield (McShield) failed to start. Verify that you have sufficient privileges to start system services.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7b 31 34 37 42 43 45 30 {147BCE0
0008: 33 2d 43 30 46 31 2d 34 3-C0F1-4
0010: 43 39 46 2d 38 31 35 37 C9F-8157
0018: 2d 36 41 38 39 42 36 44 -6A89B6D
0020: 32 44 39 37 33 7d 2D973}

Event Type: Error
Event Source: McLogEvent
Event Category: None
Event ID: 5004
User: NT AUTHORITY\SYSTEM
Description: Could not contact filter driver Error=0x7d1: The specified driver is invalid Product: McAfee VirusScan Enterprise

Cause

On dynamic disks, VSE creates an incorrect path to drivers. Consequently, McShield fails to load the drivers.

Solution 1

This issue is resolved in the VSE 8.7i Patch 1 release, which is available from the McAfee Downloads site using a valid Grant Number.

Patches are cumulative, therefore McAfee recommends that you install the latest one. For information about the latest releases, see KB51109.

McAfee product software, upgrades, maintenance releases, and documentation are available from the McAfee Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.

NOTE:
 You will need a valid Grant Number for access. KB56057 provides additional information about the McAfee Downloads site, as well as alternate locations for some products.

Solution 2

If you have Symantec Software Virtualization and Streaming installed (possibly as part of Altiris), apply Patch 2 (or later) for VSE 8.7i.

If this solution does not resolve the issue, but you are experiencing the above symptom(s), apply the following generic workaround.

Workaround 1

Modify the registry path to the core driver during the installation

CAUTION: This article contains information about opening or modifying the registry.
  • The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
  • Before proceeding, McAfee strongly recommends backing up your registry and understanding the restore process. For more information, see: http://support.microsoft.com/kb/256986.
  • Do not run a .REG file that is not confirmed to be a genuine registry import file.

  1. Start the VSE 8.7i installation locally.
  2. During installation, wait for the 1920 error to occur.

    IMPORTANT: Do not dismiss the 1920 error dialog box. 
     
  3. Click StartRun, type regedit, and click OK
  4. Navigate to and expand the following key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
     
  5. In the left pane, scroll down and select the sub-key: mfeapfk.
  6. In the right pane, right-click ImagePath and select Modify.
  7. In the Value Data field, modify the contents to state the full path.

    Example:
     
    Existing ImagePath:
    system32\drivers\mfeapfk.sys
    Modify ImagePath to include:
    \??\windows\system32\drivers\mfeapfk.sys
     
  8. Repeat the previous steps for the following two McAfee keys.

    IMPORTANT: Do not make this change for any other McAfee drivers:
    • mfeavfk.sys
    • mfebopk.sys 
  9. Close the registry editor.
  10. Dismiss the error and try to install again. 

Upgrades to VSE 8.8
IMPORTANT: If you do not make the following change, the drivers might not load, and your computer will be left unprotected.

If you have upgraded to VSE 8.8, ensure that you change the path statement to:

System32\drivers\driver_name.sys
(where driver_name.sys refers to mfeavfk.sys, mfebopk.sys and mfeapfk.sys).

Rate this document

Did this article resolve your issue?

Please provide any comments below

Glossary of Technical Terms


Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.
United States - English
© 2003-2013 McAfee, Inc.