Loading...

Knowledge Center


scan64.exe suffers unhandled exceptions (On-Demand Scan terminates prematurely with VirusScan Enterprise 8.8 Patch 8)
Technical Articles ID:   KB88785
Last Modified:  2/28/2017

Environment

McAfee VirusScan Enterprise (VSE) 8.8 Patch 8 (build 8.8.0.1599)

Problem

​In rare circumstances a scheduled or manually triggered On-Demand Scan may fail to complete with the respective scan process: 

scan64.exe/scan32.exe terminating unexpectedly

The Windows Application Event Log records the following errors:
 
Type: Application Error
Event ID: 1000
Source: n/a
Description Name der fehlerhaften Anwendung: scan64.exe. Version: 8.8.0.1599. Zeitstempel: 0x57d730f5  Name des fehlerhaften Moduls: ntdll.dll. Version: 10.0.10586.672. Zeitstempel: 0x580ee321  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0000000000036544  ID des fehlerhaften Prozesses: 0xa18  Startzeit der fehlerhaften Anwendung: 0xscan64.exe0  Pfad der fehlerhaften Anwendung: scan64.exe1  Pfad des fehlerhaften Moduls: scan64.exe2  Berichtskennung: scan64.exe3  Vollständiger Name des fehlerhaften Pakets: scan64.exe4  Anwendungs-ID. die relativ zum fehlerhaften Paket ist: scan64.exe5 

The stack of the crashing scan process may exhibit traits similar to the following:
 
STACK_TEXT:  
00000000`23cfefa8 00000000`5605eafd : 00000000`27ed1000 00000000`27ed1000 00000000`00004000 00000000`00000001 : msvcrt!wcschr+0xb
00000000`23cfefb0 00000000`5602e5dc : 00000000`085e7fe0 00000000`102aacc0 00000000`00000001 00000000`243c2f30 : mytilus3_worker!SetDebugFile+0x2eaad
00000000`23cfeff0 00007ffb`89d3491b : 00000000`0fdc0e90 00000000`102aacc0 00000000`0f594cc0 00000000`00000010 : mytilus3_worker!GetFilesStreams+0x1ac
00000000`23cff2b0 00007ffb`89d340ce : 00000000`0f594cc0 00000000`0fdc0e90 00000000`00000000 00000000`00000000 : vsodscpl+0x491b
00000000`23cff590 00007ffb`89d33e7f : 00000000`0fdc0e90 00000000`0fdc0e90 00000000`00000000 00000000`23cff678 : vsodscpl+0x40ce
00000000`23cff610 00007ffb`89d648e5 : 00000000`0f678e00 00000000`0fdc0f90 00000000`00000000 00000000`0fdc0e90 : vsodscpl+0x3e7f

00000000`23cff6f0 00007ffb`89d64c98 : 00007ffb`00003aa0 00000000`1f0a6fc0 00000000`0f678ee0 00000000`ffffffff : vsodscpl!NaiPluginInit1+0x28785
00000000`23cff730 00007ffb`b0f593c7 : 00000000`1f0a6fc0 00000000`00000000 00000000`00000000 00000000`00000000 : vsodscpl!NaiPluginInit1+0x28b38
00000000`23cff760 00007ffb`ba298102 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : vfbasics!AVrfpStandardThreadFunction+0x2b
00000000`23cff7a0 00007ffb`bc22c5b4 : 00007ffb`ba2980e0 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x22
00000000`23cff7d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x34

Cause

There is a malformed Alternate Data Stream of a directory/file scanned by the On-Demand Scan. This can happen with files/directories that are being stored in temporary locations (%temp%), by a browser or similar application.

Solution

This issue is resolved in VirusScan Enterprise 8.8.0 Update 9, which is available from the Product Downloads site at: http://mcafee.com/us/downloads/downloads.aspx.

NOTE: You need a valid Grant Number for access. KB56057 provides additional information about the Product Downloads site, and alternate locations for some products.

Updates are cumulative; Technical Support recommends that you install the latest one.

Workaround

Delete all temporary files in user temp directories and system temp directories.

Rate this document

Languages:

This article is available in the following languages:

English United States
Japanese

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.