Loading...

Knowledge Center


DAT update fails with the DAT reported at the ePolicy Orchestrator console as '0.0000' on systems with VirusScan Enterprise 8.8
Technical Articles ID:   KB79215
Last Modified:  4/7/2017
Rated:


Environment

McAfee VirusScan Enterprise (VSE) 8.8

For details of VSE 8.x supported environments, see KB51111.

Problem

The following symptoms are reported on a small number of systems that have VSE 8.8 after a DAT update:
  • The VSE About screen reports DAT: none
  • The MFERunTime DAT file at the following location is zero bytes.

    Example: C:\Program Files\Common Files\McAfee\Engine\mferuntime<date/time>.dat
     
  • The following registry key does not contain the expected DAT version:

    HKEY_LOCAL_MACHINE\Software\McAfee\AVEngine
    "AVDatVersion"=dword:00000000(0)
     
  • At the ePolicy Orchestrator (ePO) console, the client DATs are reported as: 0.0000
The Windows System Application Event log records one the following messages:

SOURCE: McLogEvent, ID: 5000, McShield service is started Engine version :0.0000  DAT version :0.0000

SOURCE: McLogEvent, ID: 5022, MCSCAN32 Engine Initialisation failed. Engine returned error: 8

System Change

Affected clients have recently performed a DAT/Engine update.

Solution

VSE 8.8 Patch 6 (and later) prevent this issue from occurring, and contain a code change that could resolve the issue (or greatly reduce the likelihood of it occurring) in affected machines.

The new code detects when a DAT update has resulted in conditions that could lead to the DAT 0000 symptom if the update proceeded. Instead of proceeding, a DAT rollback is initiated, restoring the prior DAT and allowing the system to retry the update while ensuring the scanner stays functional.

This avoidance logic can be exercised up to three times consecutively. The fourth consecutive occurrence will result in the DAT 0000 symptom. If you have a machine that still sees this issue despite the avoidance attempts, and are willing to troubleshoot, then contact Technical Support to assist us in further investigation of this issue.

VSE 8.8 Update 11 is the latest update available from the Downloads tab on the ServicePortal at https://support.mcafee.com/downloads.

NOTE: VSE 8.8 Update 11 supports all supported Windows operating systems.

Updates are available when you log on to the ServicePortal at: https://support.mcafee.com/downloads.


Use the following workarounds only if you are unable to upgrade immediately.

Workaround

For systems that have already encountered this issue, do the following and verify the results after each step:
  1. Restart your system and perform an update.
  2. Use the XDAT package to update to the latest DAT release. You can find the latest XDAT package at http://www.mcafee.com/apps/downloads/security-updates/security-updates.aspx.  
  3. Restart your computer.

    IMPORTANT: Technical Support has found that this procedure has mixed results. If you have done the procedure and clients still report the listed symptoms, contact Technical Support for additional assistance.

    To contact Technical Support, log on to the ServicePortal and go to the Create a Service Request page at https://support.mcafee.com/ServicePortal/faces/serviceRequests/createSR:
    • If you are a registered user, type your User Id and Password, and then click Log In.
    • If you are not a registered user, click Register and complete the required fields. Your password and logon instructions will be emailed to you.
 

Workaround

Some customers have reported successfully avoiding reoccurrences of symptoms by modifying the Agent Update task.

When configuring the content that the Agent Update task should retrieve from the repository (whether a McAfee or internal repository), deselect the Engine content option.

NOTE: The Agent continues to retrieve DAT updates as usual. Checking for Engine content is unnecessary if the client has already updated to the most current engine.

Rate this document

Did this article resolve your issue?

Please provide any comments below

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.