Loading...

Knowledge Center

Citrix Server becomes unresponsive because of a deadlock with the process werfault.exe and McShield
Technical Articles ID:   KB89922
Last Modified:  11/13/2017

Environment

McAfee VirusScan Enterprise (VSE) 8.8 with or without Patch 1 to 9

Microsoft Windows Server 2008 R2 (x64)
Microsoft Citrix Server (Terminal Services or Citrix virtualization infrastructure)

For details of VSE supported environments, see KB51111.

Problem

Users cannot access the Citrix Server using the Remote Desktop Protocol (RDP).

The Citrix Server randomly enters into a completely unresponsive state.

A trace reports the following:
Error walking the list of completion port threads -- trying to display partial list...
Error walking the list of completion port threads -- trying to display partial list...
Error walking large message queue -- trying to display partial list
Error querying field PortMessage.u2.s2.Type of structure nt!_KALPC_MESSAGE at

Cause

The WerFault.exe process is suspending the McShield threads. Reporting by VSE mfehidk driver to McShield is being suspended, leading to McShield being left in an intermediate state. The state of the McShield is caused by a deadlock with WerFault.

NOTE: Werfault.exe is used for windows error reporting. It is a feature that allows Microsoft to track and address errors relating to the operating system.

Solution

This issue is resolved in VirusScan Enterprise 8.8 Update 10, which is available from the Product Downloads site at: http://mcafee.com/us/downloads/downloads.aspx.

NOTE: You need a valid Grant Number for access. KB56057 provides additional information about the Product Downloads site, and alternate locations for some products.

Updates are cumulative; Technical Support recommends that you install the latest one.

The following is extracted from the VSE 8.8 Patch 10 release notes (PD27206)

1181839 - The Microsoft WERFAULT feature was removed from synchronous scans to avoid a deadlock with McShield.exe.

To review other known and resolved VSE issues, see KB70393.

VSE 8.8 Patch 11 is the latest patch available from the Downloads tab on the ServicePortal at https://support.mcafee.com/downloads.

NOTE: VSE 8.8 Patch 11 supports all supported Windows operating systems.

Workaround

Set werfault.exe as a Low-Risk process with the scanning set to OFF.

For instructions on how to create low-risk and high-risk process exclusions for VSE 8.x in ePolicy Orchestrator, see KB67544.

Rate this document

Languages:

This article is available in the following languages:

English United States
Japanese

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.