Loading...

Knowledge Center

System crash (blue screen) Bugcheck 50 with VirusScan Enterprise 8.8 Patch 4
Technical Articles ID:   KB81529
Last Modified:  6/23/2016
Rated:

Environment

McAfee VirusScan Enterprise (VSE) 8.8 Patch 4

For details of VSE 8.x supported environments, see KB51111.

Summary

A number of customers have reported this issue on server class systems that fail at unpredictable times. The issue has been reported to occur when VSE is performing a lot of scan activity (file activities).

The server class systems include a build server for a development environment and Citrix servers, because they provide files to numerous users concurrently. The risk of experiencing the failure is undetermined, but is higher for busier systems.

Problem

Random Bugcheck 50 system crash (blue screen) on server class systems.

The stack of the crashing thread indicates a call to nt!PsGetProcessId prior to failing.

Example stack text from a 64-bit system:

STACK_TEXT: 
fffff880`06f8ce28 fffff800`01f46bf0 : 00000000`00000050 fffffa80`15205cb0 00000000`00000000 fffff880`06f8cf90 : nt!KeBugCheckEx
fffff880`06f8ce30 fffff800`01ec6cee : 00000000`00000000 fffffa80`15205cb0 00000000`00000000 00000000`00000001 : nt!wcsncat_s+0x2d7f8
fffff880`06f8cf90 fffff800`01e930f0 : fffff880`04478c10 00000000`00000005 00000000`00000001 fffff880`044ab140 : nt!KeSynchronizeExecution+0x28be
fffff880`06f8d128 fffff880`04478c10 : 00000000`00000005 00000000`00000001 fffff880`044ab140 fffff880`044ab140 : nt!PsGetProcessId
fffff880`06f8d130 fffff880`04471951 : 00000000`00000000 00000000`00000001 00000000`00000000 fffffa80`106c2c90 : mfeavfk+0xec10
fffff880`06f8d2e0 fffff880`04473501 : fffffa80`13d07160 00000000`00000000 fffffa80`106c2d70 fffffa80`106c2dc8 : mfeavfk+0x7951
fffff880`06f8d380 fffff880`0151f94f : 00000000`00000000 00000000`00000000 fffffa80`10ef8f20 00000000`00100021 : mfeavfk+0x9501
fffff880`06f8d3b0 fffff880`015560a7 : fffffa80`106c2c90 00000000`00000000 00000000`00000000 fffffa80`11138db0 : mfehidk+0x2b94f
fffff880`06f8d3e0 fffff880`01272288 : fffffa80`1f155fb8 00000000`00000000 fffffa80`1f155fb8 00000000`00000000 : mfehidk+0x620a7
fffff880`06f8d410 fffff880`01270d1b : fffffa80`1d004c40 fffffa80`11138f00 fffffa80`1c4379f0 fffffa80`1c437c10 : fltmgr!FltIsCallbackDataDirty+0x1998
fffff880`06f8d4e0 fffff880`012902b9 : fffffa80`1f155cf0 fffffa80`1c537800 fffffa80`1f155c00 fffffa80`1c3c3de0 : fltmgr!FltIsCallbackDataDirty+0x42b
fffff880`06f8d570 fffff800`021c843c : 00000000`00000005 fffffa80`1e46bcc8 fffffa80`10ef8f20 00000000`00000000 : fltmgr!FltReadFile+0x10379
fffff880`06f8d620 fffff800`021c3db8 : fffffa80`1c3af9d0 fffff800`00000000 fffffa80`1e46bb10 fffffa80`00000001 : nt!MmCreateSection+0x279c
fffff880`06f8d780 fffff800`021c4fd6 : 00000000`00000000 fffffa80`1e46bb10 fffff880`06f8d890 fffffa80`0cdacf30 : nt!SeQueryInformationToken+0xc48
fffff880`06f8d870 fffff800`021c68dc : 00000000`00000000 00000000`00000000 00000000`00000001 ffffffff`ffffffff : nt!ObOpenObjectByName+0x306
fffff880`06f8d940 fffff800`021b0ed8 : 00000000`015de380 00000000`00100021 00000000`015de438 00000000`015de468 : nt!MmCreateSection+0xc3c
fffff880`06f8d9e0 fffff800`01ec7e53 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtOpenFile+0x58
fffff880`06f8da70 00000000`775c15ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeSynchronizeExecution+0x3a23
 

System Change

Either of the following products that use the driver version 15.1.0.656 were installed:
  • VSE 8.8 Patch 4
  • Host Intrusion Prevention 8.0 Patch 4

Cause

A data structure used for scanning is able to be updated by multiple threads, without having the requisite guards in place to guarantee the state of the data. The failure occurs when a thread uses the data and the content is unexpected.

Solution

This issue was resolved in VSE 8.8 patch 5.

{GENRLS.EN_US}
{GENSPPA.EN_US}

Disclaimer

The content of this article originated in English. If there are differences between the English content and its translation, the English content is always the most accurate. Some of this content has been provided using Machine Translation translated by Microsoft.

Rate this document

Did this article resolve your issue?

Please provide any comments below

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.