Loading...VirusScan Enterprise remnants remain after upgrade to Endpoint Security
Technical Articles ID:
KB89559
Last Modified: 3/1/2020 Environment
McAfee Endpoint Security (ENS) Threat Prevention 10.5.x McAfee VirusScan Enterprise (VSE) 8.8 Patch 7 and 8 Problem
Systems with VSE 8.8 Patch 7 and 8 installed leave VSE remnants when migrating the system to ENS 10.5.x. The VSE product key in the registry is being deleted, which leads to subsequent reinstall attempts by ENS to fail to initiate another VSE uninstall. Viewing the status of the system at either of the following locations does not show VSE as installed:
Several of the ENS/VSE logs are incomplete, indicating the uninstall was interrupted and could not complete. The Retrieved property from CustomAction Data: FOUND_MFEHIDIN_X86EXE=C:\Program Files (x86)\McAfee\VirusScan Enterprise\VSCore\MFEHIDIN.EXE Retrieved property from CustomAction Data: FOUND_MFEHIDIN_X64EXE=C:\Program Files (x86)\McAfee\VirusScan Enterprise\VSCore\X64\MFEHIDIN.EXE Retrieved property from CustomAction Data: TempFolder=C:\windows\TEMP\ Retrieved property from CustomAction Data: CORE_FEATURES_REMOVE=OAS ELAM AAC DiskFilter firecore_driver EmailScan ScriptScan EmailScan_Unregister ScriptScan_Unregister Retrieved property from CustomAction Data: ETLTRACE=1 Retrieved property from CustomAction Data: COREREF=VSE88P7 Retrieved property from CustomAction Data: VersionNT64=601 szMfeHidinExe = C:\Program Files (x86)\McAfee\VirusScan Enterprise\VSCore\MFEHIDIN.EXE MSI (s) (04:50) [16:08:19:913]: Running as a service. MSI (s) (04:18) [16:08:38:053]: Running as a service. MSI (s) (04:18) [16:08:56:203]: Running as a service. MSI (s) (04:18) [16:09:14:352]: Running as a service. MSI (s) (04:A0) [16:09:32:516]: Running as a service. MSI (s) (04:A0) [16:09:50:659]: Running as a service. MSI (s) (04:A0) [16:10:08:817]: Running as a service. MSI (s) (04:A0) [16:10:27:085]: Running as a service. MSI (s) (04:D8) [16:10:45:321]: Running as a service. MSI (s) (04:D8) [16:11:03:542]: Running as a service. MSI (s) (04:D8) [16:11:21:856]: Running as a service. ..... MSI (s) (04:A0) [12:17:10:341]: Running as a service. MSI (s) (04:34) [12:17:28:593]: Runni The System Core Installer log records the following. The log shows that services are in a repeated pending state. The log is also incomplete, spans over several days, waiting on
McAfee System Core Installer Copyright 2005-2011 McAfee Inc. All Rights Reserved Version SYSCORE.15.4.0.811 ********************************************* [15:27:58:556] - "C:\Program Files (x86)\McAfee\VirusScan Enterprise\VSCore\x64\MFEHIDIN.EXE" -u VSE88P7 -q -l C:\windows\TEMP\McAfeeLogs\vse8.8.0.core_uninstall_042717_152756.log -etl C:\windows\TEMP\McAfeeLogs\vse8.8.0.core_uninstall_042717_152756.etl -x vse.xml OAS ELAM AAC DiskFilter firecore_driver EmailScan ScriptScan EmailScan_Unregister ScriptScan_Unregister [15:27:58:556] - SystemArchitecture is x64 [15:27:58:556] - ETL TRACING ON [15:27:58:556] - App-V Client doesn't seem to have been installed. RegKeyOpenRead Software\Microsoft\AppV\Client\Virtualization failed 0 [15:27:58:634] - Using user specified install ref VSE88P7 ... [15:27:58:946] - StartStopMFeServices: stopping [15:27:58:946] - GetServiceReferenceCount: service mfemms has 8 references [15:27:58:946] - StartStopAllMMSServices: start=false [15:27:58:977] - StopMMSService: eiaservice, disable=0 [15:27:58:977] - GetMMSServiceState: [15:27:58:977] - Service eiaservice has state SERVICE_RUNNING [15:27:58:977] - GetMMSServiceState: return=1 [15:27:58:977] - 0 services found that depend on eiaservice [15:27:58:977] - StopMMSService: found 0 dependent services: [15:27:58:977] - Wait for MMS Service eiaservice to report STOPPED [15:27:58:977] - MMS Service eiaservice: [15:27:58:977] - SERVICE_STOP_PENDING [15:28:00:085] - MMS Service eiaservice: [15:28:00:085] - 2 [15:28:00:085] - SERVICE_STOP_PENDING [15:28:01:099] - MMS Service eiaservice: [15:28:01:099] - SERVICE_RUNNING after SERVICE_STOP_PENDING - will try and send SERVICE_CONTROL_STOP again [15:28:01:099] - GetMMSServiceState: [15:28:01:099] - Service eiaservice has state SERVICE_RUNNING [15:28:01:099] - GetMMSServiceState: return=1 [15:28:01:099] - 0 services found that depend on eiaservice [15:28:01:099] - StopMMSService: found 0 dependent services: [15:28:01:114] - Wait for MMS Service eiaservice to report STOPPED [15:28:01:114] - MMS Service eiaservice: [15:28:01:114] - SERVICE_STOP_PENDING [15:28:02:128] - MMS Service eiaservice: [15:28:02:128] - 2 [15:28:02:128] - SERVICE_STOP_PENDING [15:28:03:142] - MMS Service eiaservice: [15:28:03:142] - SERVICE_RUNNING after SERVICE_STOP_PENDING - will try and send SERVICE_CONTROL_STOP again [15:28:03:142] - GetMMSServiceState: [15:28:03:142] - Service eiaservice has state SERVICE_RUNNING [15:28:03:142] - GetMMSServiceState: return=1 ... [15:28:56:089] - MMS Service mfecore: [15:28:56:089] - SERVICE_RUNNING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOP_PENDING) [15:28:57:103] - MMS Service mfecore: [15:28:57:103] - SERVICE_RUNNING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOP_PENDING) [15:28:58:117] - MMS Service mfecore: [15:28:58:117] - SERVICE_RUNNING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOP_PENDING) [15:28:59:131] - MMS Service mfecore: [15:28:59:131] - SERVICE_RUNNING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOP_PENDING) [15:29:00:145] - MMS Service mfecore: [15:29:00:145] - SERVICE_RUNNING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOP_PENDING) [15:29:01:159] - MMS Service mfecore: [15:29:01:159] - SERVICE_RUNNING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOP_PENDING) [15:29:02:173] - MMS Service mfecore: [15:29:02:173] - SERVICE_STOP_PENDING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOPPED) [15:29:03:187] - MMS Service mfecore: [15:29:03:187] - SERVICE_STOP_PENDING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOPPED) [15:29:04:201] - MMS Service mfecore: [15:29:04:201] - SERVICE_STOP_PENDING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOPPED) [15:29:05:215] - MMS Service mfecore: [15:29:05:215] - SERVICE_STOP_PENDING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOPPED) [15:29:06:229] - MMS Service mfecore: [15:29:06:229] - SERVICE_STOP_PENDING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOPPED) [15:29:07:243] - MMS Service mfecore: [15:29:07:243] - SERVICE_STOP_PENDING, Dependencies: mfeatp(SERVICE_STOPPED) mfetp(SERVICE_STOPPED) [15:29:08:257] - MMS Service mfecore: [15:29:08:257] - SERVICE_STOPPED [15:29:08:257] - StopMMSService: exit=1 [15:29:08:257] - StopMMSService: mfedxl, disable=0 [15:29:08:257] - GetMMSServiceState: [15:29:08:257] - Service mfedxl has state SERVICE_RUNNING [15:29:08:257] - GetMMSServiceState: return=1 [15:29:08:257] - 0 services found that depend on mfedxl [15:29:08:257] - StopMMSService: found 0 dependent services: [15:29:08:272] - Wait for MMS Service mfedxl to report STOPPED [15:29:08:272] - MMS Service mfedxl: [15:29:08:272] - SERVICE_STOP_PENDING [15:29:09:286] - MMS Service mfedxl: [15:29:09:286] - SERVICE_STOPPED [15:29:09:286] - StopMMSService: exit=1 [15:29:09:286] - StopMMSService: mfeesp, disable=0 [15:29:09:286] - GetMMSServiceState: [15:29:09:286] - Service mfeesp has state SERVICE_RUNNING [15:29:09:286] - GetMMSServiceState: return=1 [15:29:09:286] - 0 services found that depend on mfeesp [15:29:09:286] - StopMMSService: found 0 dependent services: [15:29:09:302] - Wait for MMS Service mfeesp to report STOPPED [15:29:09:302] - MMS Service mfeesp: [15:29:09:302] - SERVICE_STOP_PENDING [15:29:10:316] - MMS Service mfeesp: [15:29:10:316] - SERVICE_STOP_PENDING [15:29:11:330] - MMS Service mfeesp: [15:29:11:330] - SERVICE_STOP_PENDING [15:29:12:344] - MMS Service mfeesp: [15:29:12:344] - SERVICE_STOP_PENDING [15:29:13:358] - MMS Service mfeesp: [15:29:13:358] - SERVICE_STOP_PENDING [15:29:14:372] - MMS Service mfeesp: [15:29:14:372] - SERVICE_STOP_PENDING [15:29:15:386] - MMS Service mfeesp: [15:29:15:386] - SERVICE_STOPPED [15:29:15:386] - StopMMSService: exit=1 [15:29:15:386] - StopMMSService: mfefire, disable=0 [15:29:15:386] - GetMMSServiceState: [15:29:15:386] - Service mfefire has state SERVICE_RUNNING [15:29:15:386] - GetMMSServiceState: return=1 [15:29:15:386] - 1 services depend on mfefire [15:29:15:386] - eiaservice depends on mfefire [15:29:15:386] - StopMMSService: found 1 dependent services: eiaservice [15:29:15:402] - Wait for MMS Service mfefire to report STOPPED [15:29:15:402] - MMS Service mfefire: [15:29:15:402] - SERVICE_RUNNING, Dependencies: eiaservice(SERVICE_STOPPED) [15:29:16:416] - MMS Service mfefire: [15:29:16:416] - SERVICE_RUNNING, Dependencies: eiaservice(SERVICE_RUNNING) [15:29:17:430] - MMS Service mfefire: [15:29:17:430] - SERVICE_RUNNING, Dependencies: eiaservice(SERVICE_RUNNING) .... [12:57:45:891] - MMS Service mfefire: [12:57:45:891] - SERVICE_RUNNING, Dependencies: eiaservice(SERVICE_RUNNING) [12:57:46:905] - MMS Service mfefire: [12:57:46:905] - SERVICE_RUNNING, Dependencies: eiaservice(SERVICE_RUNNIN Cause
The Solution
This issue is resolved in VSE 8.8 Patch 9. First upgrade to VSE 8.8 Patch 9 and then migrate to ENS. McAfee product software, upgrades, maintenance releases, and documentation are available from the Product Downloads site at: https://www.mcafee.com/enterprise/en-us/downloads/my-products.html.
NOTE: You need a valid Grant Number for access. See KB56057 - How to download Enterprise product updates and documentation for more information about the Product Downloads site, and alternate locations for some products. Affected ProductsLanguages:This article is available in the following languages: English United StatesSpanish Spain French Italian Japanese Portuguese Brasileiro Chinese Simplified Glossary of Technical Terms |
|
Question?
