Loading...

Knowledge Center


System crash (blue screen) when accessing exFAT-formatted removable media encrypted with File and Removable Media Protection
Technical Articles ID:   KB89066
Last Modified:  4/11/2017

Environment

McAfee File and Removable Media Protection (FRP) 5.x, 4.3.x
McAfee VirusScan Enterprise (VSE) 8.8.0 including Patch 1 to 8

For details of FRP supported environments, see KB81149.
For details of VSE 8.x supported environments, see KB51111.

Problem

After formatting a USB media using exFat and encrypting it with FRP, then inserting the device into a system with an FRP client installed, the system crashes when the drive is accessed.

The issue is typically seen on large USB drives 500GB or greater.

NOTE: The issue is not seen if the removable media is formatted with NTFS and then encrypted. 

Problem

System crash shows no references to any FRP drivers. The crash details do point to a VSE driver component (mfehidk):

Crash details:
 
af05b4b8 99a15da0 0000012c 0011013b 00000502 nt!KeBugCheckEx+0x1e
af05b4dc 99a1563e 86384da8 af05b508 af05b518 exfat!FppDecodeFileObject+0x8a
af05b53c 99a15bdd 89b94848 8a7252b0 36a5c429 exfat!FppCommonQueryInformation+0x3e
af05b584 83447129 86c34c28 8a7252b0 8a7252b0 exfat!FppFsdQueryInformation+0x41
af05b59c 8abbd20c 86be3178 8a7252b0 00000000 nt!IofCallDriver+0x63
af05b5c0 8abbd3cb af05b5e0 86be3178 00000000 FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
af05b5f8 83447129 86be3178 8a7252b0 86be3178 FLTMGR!FltpDispatch+0xc5
af05b610 8ad03866 00000000 85ff7d00 86bebdb8 nt!IofCallDriver+0x63
WARNING: Stack unwind information not available. Following frames may be wrong.
...
...
af05b830 8ad0815e 85ff7d78 85ff7d00 85ff7d80 mfehidk+0x2673e
af05b864 8ad0ba5b af05b914 01240348 86e82da8 mfehidk+0x1515e
af05b8fc 8ad61177 00000000 86240008 86e82da8 mfehidk+0x18a5b
af05b934 83447129 01bd1678 86240008 92ce5308 mfehidk!DEVICEDISPATCH::DispatchPassThrough+0xa7

Solution

This issue is resolved in VirusScan Enterprise 8.8.0 Update 9, which is available from the Product Downloads site at: http://mcafee.com/us/downloads/downloads.aspx.

NOTE: You need a valid Grant Number for access. KB56057 provides additional information about the Product Downloads site, and alternate locations for some products.

Updates are cumulative; Technical Support recommends that you install the latest one.


To view other known or resolved VSE issues, see KB70393.
To view other known or resolved FRP issues, see KB85807.

VSE 8.8 Update 11 is the latest update available from the Downloads tab on the ServicePortal at https://support.mcafee.com/downloads.

NOTE: VSE 8.8 Update 11 supports all supported Windows operating systems.

 

Rate this document

Did this article resolve your issue?

Please provide any comments below

Languages:

This article is available in the following languages:

English United States
Japanese

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.