Loading...

Knowledge Center


Bugcheck 7E with VirusScan Enterprise 8.8 Patch 6
Technical Articles ID:   KB86341
Last Modified:  8/19/2016

Environment

McAfee VirusScan Enterprise (VSE) 8.8 Patch 6
McAfee Agent (MA) 5.0.2

Problem

A blue screen error (BSOD) with bugcheck code 7E can occur after installing any of the following product versions:
  • VirusScan Enterprise 8.8 Patch 6
  • McAfee Agent 5.0.2
A Stack Trace of this failure may resemble the following:
 
fffff880`0cbea308 fffff800`bd0336b7 : 00000000`0000007e ffffffff`c0000005 fffff880`00a8b03b fffff880`0cbeb2f8 : nt!KeBugCheckEx
fffff880`0cbea310 fffff800`bcf42c9e : fffff880`0cbeb2f8 fffff880`0cbeab30 fffff800`bd24b4b1 fffff880`0cbeab30 : nt! ?? ::FNODOBFM::`string'+0x1607
fffff880`0cbea350 fffff800`bcf464ad : 00000000`00000000 fffff880`0cbecc10 fffff880`0cbea4f0 fffff880`0cbe7000 : nt!_C_specific_handler+0x8e
fffff880`0cbea3c0 fffff800`bcf4827b : 00000000`00000000 fffff880`0cbe7000 f76e34a0`00000d8c fffff880`0cbed000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0cbea3f0 fffff800`bcf648be : fffff880`0cbeb2f8 fffff880`0cbeb030 fffff880`0cbeb2f8 00000000`0000005a : nt!RtlDispatchException+0x44b
fffff880`0cbeab00 fffff800`bcee5142 : fffff680`00000000 fffff880`0cbeb3a0 00000000`00000002 00000000`00000000 : nt!KiDispatchException+0x455
fffff880`0cbeb1c0 fffff800`bcee38ba : 00000000`00000000 fffffa80`3dc14ac0 fffffa80`41d00b00 fffff880`0cbeb3a0 : nt!KiExceptionDispatch+0xc2
fffff880`0cbeb3a0 fffff880`00a8b03b : fffffa80`3dc14ac0 fffff880`00a8b391 fffffa80`3dc14ac0 00000000`00000001 : nt!KiPageFault+0x23a (TrapFrame @ fffff880`0cbeb3a0)
fffff880`0cbeb530 fffff880`00a8e973 : fffffa80`6877b010 00000000`00000000 fffffa80`3dc14ac0 00000000`00000000 : mfehidk!VHMINI_FILEOBJCTX::InitNames+0xbb 
fffff880`0cbeb570 fffff880`00a8eae4 : fffff8a0`0565eec0 fffff880`0cbeb650 fffffa80`34904010 fffffa80`2c5c5c90 : mfehidk!VHMINI_FILEOBJCTX::QueryFileName+0x163 
fffff880`0cbeb5c0 fffff880`050fb502 : 00000000`00000000 00000000`00000000 fffff880`0cbeb778 fffffa80`65f34810 : mfehidk!VHMINI_FILEIO::GetFileNameEx+0x34 
fffff880`0cbeb5f0 fffff880`050fb83c : 00000000`00000000 00000000`00000000 fffff880`0cbebdc0 fffffa80`6fca2001 : mfeaack+0xb502
fffff880`0cbeb650 fffff880`05118a6e : fffffa80`000000b9 00000000`00000000 fffffa80`3987a800 00000000`000007ff : mfeaack+0xb83c
fffff880`0cbeb690 fffff880`0511bb0a : 00000000`00000002 fffffa80`6fca2001 00000000`0000000d fffff880`0cbeb990 : mfeaack+0x28a6e
fffff880`0cbeb6e0 fffff880`0511c531 : fffffa80`1aa8c900 fffffa80`1dff7000 fffffa80`6a7c23d0 fffff880`0cbebe18 : mfeaack+0x2bb0a
fffff880`0cbebbc0 fffff880`0510605c : fffffa80`1aa8c900 fffff880`0cbebe18 fffff880`0cbebdc0 fffff880`0cbebd70 : mfeaack+0x2c531
fffff880`0cbebca0 fffff880`050ff4af : fffffa80`00000000 fffff880`0cbebe18 fffffa80`34904158 fffffa80`22f0f820 : mfeaack+0x1605c
fffff880`0cbebd20 fffff880`00a51273 : 00000000`00000008 00000000`00000001 fffffa80`278af3b0 fffff880`00ac66e0 : mfeaack+0xf4af
fffff880`0cbebf00 fffff880`00a916a9 : fffffa80`34904010 fffff880`0cbec1c0 fffff880`0cbec1a8 fffffa80`32a4f828 : mfehidk!FILEHOOKFILTERLIST::FileWriteAttribPre+0xd3 
fffff880`0cbebf40 fffff880`00a92567 : fffffa80`32a4f828 fffffa80`278af0d0 00000000`00000001 fffffa80`26108160 : mfehidk!VOLHOOKMINI::ProcessWriteAttribPre+0x99 
fffff880`0cbebf90 fffff880`01243844 : fffffa80`261081c0 fffffa80`69d1b4a0 fffff880`0cbec1e9 fffffa80`3c792060 : mfehidk!VOLHOOKMINI::ProcessSetInformationPre+0x1a7 
fffff880`0cbec140 fffff880`01244a6c : fffff880`0cbec300 00000000`00000006 fffffa80`69d1b400 fffffa80`4b1bff00 : fltmgr!FltpPerformPreCallbacks+0x324
fffff880`0cbec250 fffff880`012432e9 : 00000000`00000000 00000000`00000006 fffffa80`1b66e300 fffff880`0cbec310 : fltmgr!FltpPassThroughInternal+0x8c
fffff880`0cbec280 fffff880`0124309e : fffffa80`69d1b4a0 00000000`00000000 00000000`00000000 00000000`000002d0 : fltmgr!FltpPassThrough+0x169
fffff880`0cbec2e0 fffff880`012454ee : fffffa80`71477010 fffff880`01244a6c fffff880`0cbec400 fffff880`0cbec606 : fltmgr!FltpDispatch+0x9e
fffff880`0cbec340 fffff880`012430b6 : fffffa80`2a0d3bc0 00000000`00000004 fffffa80`4b1bfc10 fffff880`00000100 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x25e
fffff880`0cbec3e0 fffff800`bd24b4b1 : 00000000`00000000 fffff880`0cbec729 00000000`00000004 fffff880`016e8180 : fltmgr!FltpDispatch+0xb6
fffff880`0cbec440 fffff880`08e941ad : fffff8a0`420030ac 00000000`00541fa0 fffffa80`39ca0000 fffff880`00e6c51c : nt!NtSetInformationFile+0x66d
fffff880`0cbec650 fffff880`08e73fff : 00000000`00541fa0 00000000`00954610 fffff8a0`42003338 00000000`00000002 : nfssvr!NfsSetNtfsAttributes+0x3f1
fffff880`0cbec790 fffff880`08e782d0 : fffff8a0`42003000 fffff880`0cbec8d0 fffff880`08f15110 fffff8a0`420030f8 : nfssvr!NfsSetFileAttributes+0x47
fffff880`0cbec7c0 fffff880`08e75a78 : fffff8a0`42003000 fffff8a0`00000180 00000000`00000000 fffff8a0`00000000 : nfssvr!NfsSetAttr+0x1754
fffff880`0cbec970 fffff880`08e1567a : 00000000`00000000 fffffa80`5b742190 fffffa80`5b742101 00000000`2b8d9083 : nfssvr!NfsInPacketInternal+0xecc
fffff880`0cbeca80 fffff880`07e5a181 : fffffa80`3627f070 fffff880`0cbecb40 00000000`00000000 fffffa80`3627f070 : nfssvr!NfsSrvMessage+0x582
fffff880`0cbecb10 fffff880`07e65cb0 : fffffa80`00000000 00000000`00000000 fffffa80`2b69d300 fffffa80`3627f028 : rpcxdr!OncRpcMsgProcessMessage+0x479
fffff880`0cbecb80 fffff800`bce8f185 : fffff880`0cbecc88 fffffa80`2d7d2480 00000000`00000080 fffff8a0`aaef2010 : rpcxdr!OncRpcWiMgrpWorker+0x22c
fffff880`0cbecc10 fffff800`bcecc656 : fffff880`02eb4180 fffffa80`2d7d2480 fffff880`02ec0d40 fffffa80`18ec7980 : nt!PspSystemThreadStartup+0x59
fffff880`0cbecc60 00000000`00000000 : fffff880`0cbed000 fffff880`0cbe7000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
 
Example Windbg Stack Text output of the failure:
 
STACK_TEXT:  
fffff880`0cbeb530 fffff880`00a8e973 : fffffa80`6877b010 00000000`00000000 fffffa80`3dc14ac0 00000000`00000000 : mfehidk!VHMINI_FILEOBJCTX::InitNames+0xbb 
fffff880`0cbeb570 fffff880`00a8eae4 : fffff8a0`0565eec0 fffff880`0cbeb650 fffffa80`34904010 fffffa80`2c5c5c90 : mfehidk!VHMINI_FILEOBJCTX::QueryFileName+0x163 
fffff880`0cbeb5c0 fffff880`050fb502 : 00000000`00000000 00000000`00000000 fffff880`0cbeb778 fffffa80`65f34810 : mfehidk!VHMINI_FILEIO::GetFileNameEx+0x34 
fffff880`0cbeb5f0 fffff880`050fb83c : 00000000`00000000 00000000`00000000 fffff880`0cbebdc0 fffffa80`6fca2001 : mfeaack!CAacFileIo::GetFileName+0xe2 
fffff880`0cbeb650 fffff880`05118a6e : fffffa80`000000b9 00000000`00000000 fffffa80`3987a800 00000000`000007ff : mfeaack!CAacFileIo::GetName+0x1c 
fffff880`0cbeb690 fffff880`0511bb0a : 00000000`00000002 fffffa80`6fca2001 00000000`0000000d fffff880`0cbeb990 : mfeaack!CAacMatchEngine::GetMatchDataSafe+0xbe 
fffff880`0cbeb6e0 fffff880`0511c531 : fffffa80`1aa8c900 fffffa80`1dff7000 fffffa80`6a7c23d0 fffff880`0cbebe18 : mfeaack!CAacMatchEngine::DoMatch+0xf5a 
fffff880`0cbebbc0 fffff880`0510605c : fffffa80`1aa8c900 fffff880`0cbebe18 fffff880`0cbebdc0 fffff880`0cbebd70 : mfeaack!CAacMatchEngine::FindMatch+0x201 
fffff880`0cbebca0 fffff880`050ff4af : fffffa80`00000000 fffff880`0cbebe18 fffffa80`34904158 fffffa80`22f0f820 : mfeaack!CAacRuleHitHandler::FindHits+0xdc 
fffff880`0cbebd20 fffff880`00a51273 : 00000000`00000008 00000000`00000001 fffffa80`278af3b0 fffff880`00ac66e0 : mfeaack!CAacFileFilter::FileWriteAttribPre+0xdf 
fffff880`0cbebf00 fffff880`00a916a9 : fffffa80`34904010 fffff880`0cbec1c0 fffff880`0cbec1a8 fffffa80`32a4f828 : mfehidk!FILEHOOKFILTERLIST::FileWriteAttribPre+0xd3 
fffff880`0cbebf40 fffff880`00a92567 : fffffa80`32a4f828 fffffa80`278af0d0 00000000`00000001 fffffa80`26108160 : mfehidk!VOLHOOKMINI::ProcessWriteAttribPre+0x99 
fffff880`0cbebf90 fffff880`01243844 : fffffa80`261081c0 fffffa80`69d1b4a0 fffff880`0cbec1e9 fffffa80`3c792060 : mfehidk!VOLHOOKMINI::ProcessSetInformationPre+0x1a7 
fffff880`0cbec140 fffff880`01244a6c : fffff880`0cbec300 00000000`00000006 fffffa80`69d1b400 fffffa80`4b1bff00 : fltmgr!FltpPerformPreCallbacks+0x324
fffff880`0cbec250 fffff880`012432e9 : 00000000`00000000 00000000`00000006 fffffa80`1b66e300 fffff880`0cbec310 : fltmgr!FltpPassThroughInternal+0x8c
fffff880`0cbec280 fffff880`0124309e : fffffa80`69d1b4a0 00000000`00000000 00000000`00000000 00000000`000002d0 : fltmgr!FltpPassThrough+0x169
fffff880`0cbec2e0 fffff880`012454ee : fffffa80`71477010 fffff880`01244a6c fffff880`0cbec400 fffff880`0cbec606 : fltmgr!FltpDispatch+0x9e
fffff880`0cbec340 fffff880`012430b6 : fffffa80`2a0d3bc0 00000000`00000004 fffffa80`4b1bfc10 fffff880`00000100 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x25e
fffff880`0cbec3e0 fffff800`bd24b4b1 : 00000000`00000000 fffff880`0cbec729 00000000`00000004 fffff880`016e8180 : fltmgr!FltpDispatch+0xb6
fffff880`0cbec440 fffff880`08e941ad : fffff8a0`420030ac 00000000`00541fa0 fffffa80`39ca0000 fffff880`00e6c51c : nt!NtSetInformationFile+0x66d
fffff880`0cbec650 fffff880`08e73fff : 00000000`00541fa0 00000000`00954610 fffff8a0`42003338 00000000`00000002 : nfssvr!NfsSetNtfsAttributes+0x3f1
fffff880`0cbec790 fffff880`08e782d0 : fffff8a0`42003000 fffff880`0cbec8d0 fffff880`08f15110 fffff8a0`420030f8 : nfssvr!NfsSetFileAttributes+0x47
fffff880`0cbec7c0 fffff880`08e75a78 : fffff8a0`42003000 fffff8a0`00000180 00000000`00000000 fffff8a0`00000000 : nfssvr!NfsSetAttr+0x1754
fffff880`0cbec970 fffff880`08e1567a : 00000000`00000000 fffffa80`5b742190 fffffa80`5b742101 00000000`2b8d9083 : nfssvr!NfsInPacketInternal+0xecc
fffff880`0cbeca80 fffff880`07e5a181 : fffffa80`3627f070 fffff880`0cbecb40 00000000`00000000 fffffa80`3627f070 : nfssvr!NfsSrvMessage+0x582
fffff880`0cbecb10 fffff880`07e65cb0 : fffffa80`00000000 00000000`00000000 fffffa80`2b69d300 fffffa80`3627f028 : rpcxdr!OncRpcMsgProcessMessage+0x479
fffff880`0cbecb80 fffff800`bce8f185 : fffff880`0cbecc88 fffffa80`2d7d2480 00000000`00000080 fffff8a0`aaef2010 : rpcxdr!OncRpcWiMgrpWorker+0x22c
fffff880`0cbecc10 fffff800`bcecc656 : fffff880`02eb4180 fffffa80`2d7d2480 fffff880`02ec0d40 fffffa80`18ec7980 : nt!PspSystemThreadStartup+0x59
fffff880`0cbecc60 00000000`00000000 : fffff880`0cbed000 fffff880`0cbe7000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

Cause

A race condition exists within the Access Control (AAC) rule matching code that can lead to a pagefault unexpectedly, and crash the system.

Solution

This issue is resolved in VSE 8.8 Patch 7.
McAfee product software, upgrades, maintenance releases, and documentation are available from the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.

NOTE: You need a valid Grant Number for access. KB56057 provides additional information about the Product Downloads site, and alternate locations for some products.

Rate this document

Languages:

This article is available in the following languages:

English United States
Japanese

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.