Systems with VSE 8.8 Patch 7 and 8 installed leave VSE remnants when migrating the system to ENS 10.5.x.
The VSE product key in the registry is being deleted, which leads to subsequent reinstall attempts by ENS to fail to initiate another VSE uninstall.
Viewing the status of the system at either of the following locations does not show VSE as installed:
- ePolicy Orchestrator (ePO) console
- McAfee icon in the windows notification area under About
The uninstall log spans over several days, waiting on
eiaservice to stop.
Several of the ENS/VSE logs are incomplete, indicating the uninstall was interrupted and could not complete.
The
McAfee_Endpoint_Security_Migration_McAfee VirusScan Enterprise_8.8_07022017140105.log abruptly stops after several days, indicating that
mfehidin might not be exiting.
> enter custom action Uninstall_SysCore()
Retrieved property from CustomAction Data: FOUND_MFEHIDIN_X86EXE=C:\Program Files (x86)\McAfee\VirusScan Enterprise\VSCore\MFEHIDIN.EXE
Retrieved property from CustomAction Data: FOUND_MFEHIDIN_X64EXE=C:\Program Files (x86)\McAfee\VirusScan Enterprise\VSCore\X64\MFEHIDIN.EXE
Retrieved property from CustomAction Data: TempFolder=C:\windows\TEMP\
Retrieved property from CustomAction Data: CORE_FEATURES_REMOVE=OAS ELAM AAC DiskFilter firecore_driver EmailScan ScriptScan EmailScan_Unregister ScriptScan_Unregister
Retrieved property from CustomAction Data: ETLTRACE=1
Retrieved property from CustomAction Data: COREREF=VSE88P7
Retrieved property from CustomAction Data: VersionNT64=601
szMfeHidinExe = C:\Program Files (x86)\McAfee\VirusScan Enterprise\VSCore\MFEHIDIN.EXE
MSI (s) (04:50) [16:08:19:913]: Running as a service.
MSI (s) (04:18) [16:08:38:053]: Running as a service.
MSI (s) (04:18) [16:08:56:203]: Running as a service.
MSI (s) (04:18) [16:09:14:352]: Running as a service.
MSI (s) (04:A0) [16:09:32:516]: Running as a service.
MSI (s) (04:A0) [16:09:50:659]: Running as a service.
MSI (s) (04:A0) [16:10:08:817]: Running as a service.
MSI (s) (04:A0) [16:10:27:085]: Running as a service.
MSI (s) (04:D8) [16:10:45:321]: Running as a service.
MSI (s) (04:D8) [16:11:03:542]: Running as a service.
MSI (s) (04:D8) [16:11:21:856]: Running as a service.
.....
MSI (s) (04:A0) [12:17:10:341]: Running as a service.
MSI (s) (04:34) [12:17:28:593]: Runni
The System Core Installer log records the following. The log shows that services are in a repeated pending state. The log is also incomplete, spans over several days, waiting on
eiaservice to stop:
********************************************
McAfee System Core Installer
Copyright 2005-2011 McAfee Inc.
All Rights Reserved Version SYSCORE.15.4.0.811
*********************************************
[15:27:58:556] - "C:\Program Files (x86)\McAfee\VirusScan Enterprise\VSCore\x64\MFEHIDIN.EXE" -u VSE88P7 -q -l C:\windows\TEMP\McAfeeLogs\vse8.8.0.core_uninstall_042717_152756.log -etl C:\windows\TEMP\McAfeeLogs\vse8.8.0.core_uninstall_042717_152756.etl -x vse.xml OAS ELAM AAC DiskFilter firecore_driver EmailScan ScriptScan EmailScan_Unregister ScriptScan_Unregister
[15:27:58:556] - SystemArchitecture is x64
[15:27:58:556] - ETL TRACING ON
[15:27:58:556] - App-V Client doesn't seem to have been installed. RegKeyOpenRead Software\Microsoft\AppV\Client\Virtualization failed 0
[15:27:58:634] - Using user specified install ref VSE88P7
...
[15:27:58:946] - StartStopMFeServices: stopping
[15:27:58:946] - GetServiceReferenceCount: service mfemms has 8 references
[15:27:58:946] - StartStopAllMMSServices: start=false
[15:27:58:977] - StopMMSService: eiaservice, disable=0
[15:27:58:977] - GetMMSServiceState:
[15:27:58:977] - Service eiaservice has state SERVICE_RUNNING
[15:27:58:977] - GetMMSServiceState: return=1
[15:27:58:977] - 0 services found that depend on eiaservice
[15:27:58:977] - StopMMSService: found 0 dependent services:
[15:27:58:977] - Wait for MMS Service eiaservice to report STOPPED
[15:27:58:977] - MMS Service eiaservice: [15:27:58:977] - SERVICE_STOP_PENDING
[15:28:00:085] - MMS Service eiaservice: [15:28:00:085] - 2
[15:28:00:085] - SERVICE_STOP_PENDING
[15:28:01:099] - MMS Service eiaservice: [15:28:01:099] - SERVICE_RUNNING after SERVICE_STOP_PENDING - will try and send SERVICE_CONTROL_STOP again
[15:28:01:099] - GetMMSServiceState:
[15:28:01:099] - Service eiaservice has state SERVICE_RUNNING
[15:28:01:099] - GetMMSServiceState: return=1
[15:28:01:099] - 0 services found that depend on eiaservice
[15:28:01:099] - StopMMSService: found 0 dependent services:
[15:28:01:114] - Wait for MMS Service eiaservice to report STOPPED
[15:28:01:114] - MMS Service eiaservice: [15:28:01:114] - SERVICE_STOP_PENDING
[15:28:02:128] - MMS Service eiaservice: [15:28:02:128] - 2
[15:28:02:128] - SERVICE_STOP_PENDING
[15:28:03:142] - MMS Service eiaservice: [15:28:03:142] - SERVICE_RUNNING after SERVICE_STOP_PENDING - will try and send SERVICE_CONTROL_STOP again
[15:28:03:142] - GetMMSServiceState:
[15:28:03:142] - Service eiaservice has state SERVICE_RUNNING
[15:28:03:142] - GetMMSServiceState: return=1
...
[15:28:56:089] - MMS Service mfecore: [15:28:56:089] - SERVICE_RUNNING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOP_PENDING)
[15:28:57:103] - MMS Service mfecore: [15:28:57:103] - SERVICE_RUNNING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOP_PENDING)
[15:28:58:117] - MMS Service mfecore: [15:28:58:117] - SERVICE_RUNNING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOP_PENDING)
[15:28:59:131] - MMS Service mfecore: [15:28:59:131] - SERVICE_RUNNING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOP_PENDING)
[15:29:00:145] - MMS Service mfecore: [15:29:00:145] - SERVICE_RUNNING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOP_PENDING)
[15:29:01:159] - MMS Service mfecore: [15:29:01:159] - SERVICE_RUNNING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOP_PENDING)
[15:29:02:173] - MMS Service mfecore: [15:29:02:173] - SERVICE_STOP_PENDING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOPPED)
[15:29:03:187] - MMS Service mfecore: [15:29:03:187] - SERVICE_STOP_PENDING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOPPED)
[15:29:04:201] - MMS Service mfecore: [15:29:04:201] - SERVICE_STOP_PENDING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOPPED)
[15:29:05:215] - MMS Service mfecore: [15:29:05:215] - SERVICE_STOP_PENDING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOPPED)
[15:29:06:229] - MMS Service mfecore: [15:29:06:229] - SERVICE_STOP_PENDING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOPPED)
[15:29:07:243] - MMS Service mfecore: [15:29:07:243] - SERVICE_STOP_PENDING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOPPED)
[15:29:08:257] - MMS Service mfecore: [15:29:08:257] - SERVICE_STOPPED
[15:29:08:257] - StopMMSService: exit=1
[15:29:08:257] - StopMMSService: mfedxl, disable=0
[15:29:08:257] - GetMMSServiceState:
[15:29:08:257] - Service mfedxl has state SERVICE_RUNNING
[15:29:08:257] - GetMMSServiceState: return=1
[15:29:08:257] - 0 services found that depend on mfedxl
[15:29:08:257] - StopMMSService: found 0 dependent services:
[15:29:08:272] - Wait for MMS Service mfedxl to report STOPPED
[15:29:08:272] - MMS Service mfedxl: [15:29:08:272] - SERVICE_STOP_PENDING
[15:29:09:286] - MMS Service mfedxl: [15:29:09:286] - SERVICE_STOPPED
[15:29:09:286] - StopMMSService: exit=1
[15:29:09:286] - StopMMSService: mfeesp, disable=0
[15:29:09:286] - GetMMSServiceState:
[15:29:09:286] - Service mfeesp has state SERVICE_RUNNING
[15:29:09:286] - GetMMSServiceState: return=1
[15:29:09:286] - 0 services found that depend on mfeesp
[15:29:09:286] - StopMMSService: found 0 dependent services:
[15:29:09:302] - Wait for MMS Service mfeesp to report STOPPED
[15:29:09:302] - MMS Service mfeesp: [15:29:09:302] - SERVICE_STOP_PENDING
[15:29:10:316] - MMS Service mfeesp: [15:29:10:316] - SERVICE_STOP_PENDING
[15:29:11:330] - MMS Service mfeesp: [15:29:11:330] - SERVICE_STOP_PENDING
[15:29:12:344] - MMS Service mfeesp: [15:29:12:344] - SERVICE_STOP_PENDING
[15:29:13:358] - MMS Service mfeesp: [15:29:13:358] - SERVICE_STOP_PENDING
[15:29:14:372] - MMS Service mfeesp: [15:29:14:372] - SERVICE_STOP_PENDING
[15:29:15:386] - MMS Service mfeesp: [15:29:15:386] - SERVICE_STOPPED
[15:29:15:386] - StopMMSService: exit=1
[15:29:15:386] - StopMMSService: mfefire, disable=0
[15:29:15:386] - GetMMSServiceState:
[15:29:15:386] - Service mfefire has state SERVICE_RUNNING
[15:29:15:386] - GetMMSServiceState: return=1
[15:29:15:386] - 1 services depend on mfefire
[15:29:15:386] - eiaservice depends on mfefire
[15:29:15:386] - StopMMSService: found 1 dependent services: eiaservice
[15:29:15:402] - Wait for MMS Service mfefire to report STOPPED
[15:29:15:402] - MMS Service mfefire: [15:29:15:402] - SERVICE_RUNNING, Dependencies: eiaservice(SERVICE_STOPPED)
[15:29:16:416] - MMS Service mfefire: [15:29:16:416] - SERVICE_RUNNING, Dependencies: eiaservice(SERVICE_RUNNING)
[15:29:17:430] - MMS Service mfefire: [15:29:17:430] - SERVICE_RUNNING, Dependencies: eiaservice(SERVICE_RUNNING)
....
[12:57:45:891] - MMS Service mfefire: [12:57:45:891] - SERVICE_RUNNING, Dependencies: eiaservice(SERVICE_RUNNING)
[12:57:46:905] - MMS Service mfefire: [12:57:46:905] - SERVICE_RUNNING, Dependencies: eiaservice(SERVICE_RUNNIN