Loading...

Knowledge Center


DAT update fails with the DAT reported at the ePolicy Orchestrator console as '0.0000' on systems with VirusScan Enterprise 8.8
Technical Articles ID:   KB79215
Last Modified:  4/7/2017
Rated:


Environment

McAfee VirusScan Enterprise (VSE) 8.8

For details of VSE 8.x supported environments, see KB51111.

Problem

The following symptoms are reported on a small number of systems that have VSE 8.8 after a DAT update:
  • The VSE About screen reports DAT: none
  • The MFERunTime DAT file at the following location is zero bytes.

    Example: C:\Program Files\Common Files\McAfee\Engine\mferuntime<date/time>.dat
     
  • The following registry key does not contain the expected DAT version:

    HKEY_LOCAL_MACHINE\Software\McAfee\AVEngine
    "AVDatVersion"=dword:00000000(0)
     
  • At the ePolicy Orchestrator (ePO) console, the client DATs are reported as: 0.0000
The Windows System Application Event log records one the following messages:

SOURCE: McLogEvent, ID: 5000, McShield service is started Engine version :0.0000  DAT version :0.0000

SOURCE: McLogEvent, ID: 5022, MCSCAN32 Engine Initialisation failed. Engine returned error: 8

System Change

Affected clients have recently performed a DAT/Engine update.

Solution

VSE 8.8 Patch 6 (and later) prevent this issue from occurring, and contain a code change that could resolve the issue (or greatly reduce the likelihood of it occurring) in affected machines.

The new code detects when a DAT update has resulted in conditions that could lead to the DAT 0000 symptom if the update proceeded. Instead of proceeding, a DAT rollback is initiated, restoring the prior DAT and allowing the system to retry the update while ensuring the scanner stays functional.

This avoidance logic can be exercised up to three times consecutively. The fourth consecutive occurrence will result in the DAT 0000 symptom. If you have a machine that still sees this issue despite the avoidance attempts, and are willing to troubleshoot, then contact Technical Support to assist us in further investigation of this issue.

{VSE88PATCHES.EN_US}
{GENSPPA.EN_US}

Use the following workarounds only if you are unable to upgrade immediately.

Workaround

For systems that have already encountered this issue, do the following and verify the results after each step:
  1. Restart your system and perform an update.
  2. Use the XDAT package to update to the latest DAT release. You can find the latest XDAT package at http://www.mcafee.com/apps/downloads/security-updates/security-updates.aspx.  
  3. Restart your computer.

    IMPORTANT: Technical Support has found that this procedure has mixed results. If you have done the procedure and clients still report the listed symptoms, contact Technical Support for additional assistance.

    {GENAA.EN_US}
 

Workaround

Some customers have reported successfully avoiding reoccurrences of symptoms by modifying the Agent Update task.

When configuring the content that the Agent Update task should retrieve from the repository (whether a McAfee or internal repository), deselect the Engine content option.

NOTE: The Agent continues to retrieve DAT updates as usual. Checking for Engine content is unnecessary if the client has already updated to the most current engine.

Disclaimer

The content of this article originated in English. If there are differences between the English content and its translation, the English content is always the most accurate. Some of this content has been provided using Machine Translation translated by Microsoft.

Rate this document

Did this article resolve your issue?

Please provide any comments below

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.