Loading...

Knowledge Center

scan64.exe suffers unhandled exceptions (On-Demand Scan terminates prematurely with VirusScan Enterprise 8.8 Patch 8)
Technical Articles ID:   KB88785
Last Modified:  2/28/2017

Environment

McAfee VirusScan Enterprise (VSE) 8.8 Patch 8 (build 8.8.0.1599)

Problem

​In rare circumstances a scheduled or manually triggered On-Demand Scan may fail to complete with the respective scan process: 

scan64.exe/scan32.exe terminating unexpectedly

The Windows Application Event Log records the following errors:
 
Type: Application Error
Event ID: 1000
Source: n/a
Description Name der fehlerhaften Anwendung: scan64.exe. Version: 8.8.0.1599. Zeitstempel: 0x57d730f5  Name des fehlerhaften Moduls: ntdll.dll. Version: 10.0.10586.672. Zeitstempel: 0x580ee321  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0000000000036544  ID des fehlerhaften Prozesses: 0xa18  Startzeit der fehlerhaften Anwendung: 0xscan64.exe0  Pfad der fehlerhaften Anwendung: scan64.exe1  Pfad des fehlerhaften Moduls: scan64.exe2  Berichtskennung: scan64.exe3  Vollständiger Name des fehlerhaften Pakets: scan64.exe4  Anwendungs-ID. die relativ zum fehlerhaften Paket ist: scan64.exe5 

The stack of the crashing scan process may exhibit traits similar to the following:
 
STACK_TEXT:  
00000000`23cfefa8 00000000`5605eafd : 00000000`27ed1000 00000000`27ed1000 00000000`00004000 00000000`00000001 : msvcrt!wcschr+0xb
00000000`23cfefb0 00000000`5602e5dc : 00000000`085e7fe0 00000000`102aacc0 00000000`00000001 00000000`243c2f30 : mytilus3_worker!SetDebugFile+0x2eaad
00000000`23cfeff0 00007ffb`89d3491b : 00000000`0fdc0e90 00000000`102aacc0 00000000`0f594cc0 00000000`00000010 : mytilus3_worker!GetFilesStreams+0x1ac
00000000`23cff2b0 00007ffb`89d340ce : 00000000`0f594cc0 00000000`0fdc0e90 00000000`00000000 00000000`00000000 : vsodscpl+0x491b
00000000`23cff590 00007ffb`89d33e7f : 00000000`0fdc0e90 00000000`0fdc0e90 00000000`00000000 00000000`23cff678 : vsodscpl+0x40ce
00000000`23cff610 00007ffb`89d648e5 : 00000000`0f678e00 00000000`0fdc0f90 00000000`00000000 00000000`0fdc0e90 : vsodscpl+0x3e7f
00000000`23cff6f0 00007ffb`89d64c98 : 00007ffb`00003aa0 00000000`1f0a6fc0 00000000`0f678ee0 00000000`ffffffff : vsodscpl!NaiPluginInit1+0x28785
00000000`23cff730 00007ffb`b0f593c7 : 00000000`1f0a6fc0 00000000`00000000 00000000`00000000 00000000`00000000 : vsodscpl!NaiPluginInit1+0x28b38
00000000`23cff760 00007ffb`ba298102 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : vfbasics!AVrfpStandardThreadFunction+0x2b
00000000`23cff7a0 00007ffb`bc22c5b4 : 00007ffb`ba2980e0 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x22
00000000`23cff7d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x34

Cause

There is a malformed Alternate Data Stream of a directory/file scanned by the On-Demand Scan. This can happen with files/directories that are being stored in temporary locations (%temp%), by a browser or similar application.

Solution

{VSE88P9.EN_US}

Workaround

Delete all temporary files in user temp directories and system temp directories.

Disclaimer

The content of this article originated in English. If there are differences between the English content and its translation, the English content is always the most accurate. Some of this content has been provided using Machine Translation translated by Microsoft.

Rate this document

Did this article resolve your issue?

Please provide any comments below

Languages:

This article is available in the following languages:

English United States
Japanese

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.