Random bugchecks after uninstalling VirusScan Enterprise 8.x
技術的な記事 ID:
KB85977
最終更新: 1/24/2020
環境
McAfee VirusScan Enterprise (VSE) 8.x
Microsoft Windows 6.x (Vista and later)
概要
McAfee has received reports of some random Windows bugchecks (with multiple bugcheck codes) on systems that have recently uninstalled VSE 8.x. The bugchecks did not occur during the uninstall procedure, but did occur at some point after uninstalling and before the system was restarted normally.
The purpose of this article is not to provide an analysis on each specific memory dump, but to provide insight on proper software removal from an operating system perspective.
問題
A Windows bugcheck occurs shortly after you uninstall VSE 8.x. An example of a bugcheck code is "7f," and the offending driver might not be a McAfee driver.
原因
A removal of VSE was performed, and the system has not completed a normal shutdown/restart after removal. The removal can be completed via add and remove programs using ePolicy Orchestrator, or using the msiexec uninstall command.
解決策
It is best practice in the Microsoft Windows computing world to restart a system after removing (or installing) any software that has kernel drivers. A restart is necessary for those kernel components (drivers) to be deleted completely, or to ensure they are unloaded from memory. Until that restart is satisfied, there is a lingering risk of instability or incompatibility associated with the removed software.
For any operating system, perform a normal shutdown and restart after you remove or install VSE 8.x. A normal shutdown and restart ensures that complete software removal occurs, and that bugchecks do not occur because of driver remnants still loaded in the kernel.
回避策
CAUTION: This article contains information about opening or modifying the registry.
The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see: http://support.microsoft.com/kb/256986.
Do not run a REG file that is not confirmed to be a genuine registry import file.
Check for the existence of McAfee services and drivers that have been marked for deletion, and delete the service keys, as well as the drivers marked for deletion.
WARNING: Manual deletion of kernel components in and of itself can also incur a bugcheck. Use this method only in dire situations. Do not consider it preferable to scheduling the necessary restart of the system.
Open Regedit.
Navigate to:
HKLM\System\CurrentControlSet\Services
Check for the existence of McAfee services that have been marked for deletion. Most of these services start with a common nomenclature of mfe*. To validate that the service is a McAfee service, you can check the Image Path registry value, which points to the file location for that specific service or driver.
Within the necessary keys, there should be a DeleteOnRebootflag (value) added to the values for the key.
Delete the key, and also delete the file referenced within the image path.
Perform a normal shutdown and restart of the affected system as soon as possible.
