Loading...

Knowledge Center


AVLogEvent 5005 Content is missing. Error Code:a7f42014 (Endpoint Security AMCore content fails to update)
Technical Articles ID:   KB89207
Last Modified:  5/2/2017
Rated:


Environment

McAfee Endpoint Security (ENS) 10.x

Problem

An update task fails to install AMCore content. The ENS logs show the following errors.

McAfee_ThreatPrevention_Install_<Date_Time>.log:
 
Extracting C:\Windows\TEMP\\Amcore_OEM_Content.cab to C:\Program Files\Common Files\McAfee\Engine
Extraction failed : -2147024893
 
McAfee_ThreatPrevention_CustomAction_Install_<Date_Time>.log:
 
[TPCustomAction] Extracting C:\Windows\TEMP\\Amcore_OEM_Content.cab to C:\Program Files\Common Files\McAfee\Engine
[TPCustomAction] Extraction failed : -2147024893
 
Application events:
 
ERROR      13/02/2017      16:55:24      AVLogEvent      None      5005      SYSTEM      system.name     Content is missing.  Error Code:a7f42014        None 
 
EndpointSecurityPlatform_Debug.log and EndpointSecurityPlatform_Errors.log:
 
Orchestrator.Action.Error (post_scan_actions.cpp:989): UsingDefaultAMCoreContent - Failed to get AMCore content version from registry: 0x2
McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:150): CheckTechnologyState failed to get technology status from BO: OAS, error: 80010020L
McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): On-Access Scan is not responding.
Orchestrator.AMCoreUtil.Error (amcore_helper.cpp:547): AMCore is fully not initialized & state is 6

Cause

There is a failure to write to the directory C:\Program Files\Common Files\McAfee\Engine\. This results in the failure to update AMCore content. 

The cause of the failure to update the directory can vary. The errors listed in this article were a result of a file named engine being located at C:\Program Files\Common Files\McAfee\.

The corruption of this directory can be pre-existing on a system upgraded from VirusScan Enterprise to ENS. This can be confirmed by reviewing the VirusScan Enterprise logs on the system.

Example:
VSEInst_.log:
 
CopyFile(C:\Program Files\McAfee\VirusScan Enterprise\RepairCache\\Engine\config.dat, C:\Program Files\Common Files\McAfee\Engine\\config.dat) failed.  Last error=3
 
NOTE: The Last error=3 in the VirusScan Enterprise logs is equivalent to the -2147024893 seen in ENS logs.

Solution

This issue is resolved in Endpoint Security 10.5.2, which is available from the Product Downloads site at: http://mcafee.com/us/downloads/downloads.aspx.

NOTE: You need a valid Grant Number for access. KB56057 provides additional information about the Product Downloads site, and alternate locations for some products.

Updates are cumulative; Technical Support recommends that you install the latest one.


The ENS 10.5.2 installer has logic to delete any pre-existing files in the Engine path to proactively remediate the issue.

Workaround

Delete the file or folder named Engine located in the directory C:\Program Files\Common Files\McAfee\. Then, use a tool such as Process Monitor (Procmon) (available from https://technet.microsoft.com/en-us/sysinternals/processmonitor) to confirm there is no longer an error when the installer attempts to write to C:\Program Files\Common Files\McAfee\.

The following is an example of an error seen in Procmon when the installer attempts to write to C:\Program Files\Common Files\McAfee\:
 
McScript_InUse.exe    CreateFile    C:\Program Files\Common Files\McAfee\Engine    NAME COLLISION

Rate this document

Languages:

This article is available in the following languages:

English United States
Japanese

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.