Citrix Server becomes unresponsive because of a deadlock with the process werfault.exe and McShield

Technical Articles ID: KB89922
Last Modified: 1/29/2020

Environment

McAfee VirusScan Enterprise (VSE) 8.8 with or without Patch 1–9

Microsoft Windows Server 2008 R2 (x64)
Microsoft Citrix Server (Terminal Services or Citrix virtualization infrastructure)

For details of VSE supported environments, see KB51111.

Problem

Users can't access the Citrix Server using the Remote Desktop Protocol (RDP).

The Citrix Server randomly enters into an unresponsive state.

A trace reports the following:

Error walking the list of completion port threads -- trying to display partial list...
Error walking the list of completion port threads -- trying to display partial list...
Error walking large message queue -- trying to display partial list
Error querying field PortMessage.u2.s2.Type of structure nt!_KALPC_MESSAGE at

Cause

The WerFault.exe process is suspending the McShield threads. Reporting by VSE mfehidk driver to McShield is suspended, which leads to McShield being left in an intermediate state. The state of the McShield is caused by a deadlock with WerFault.

NOTE: The werfault.exe is used for windows error reporting. It is a feature that allows Microsoft to track and address errors relating to the operating system.

Solution

This issue is resolved in VirusScan Enterprise 8.8 Update 10, which is available from the Product Downloads site at: https://www.mcafee.com/enterprise/en-us/downloads/my-products.html.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download Enterprise product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Updates are cumulative; Technical Support recommends that you install the latest one.

The following is extracted from the VSE 8.8 Patch 10 release notes:

1181839 - The Microsoft WERFAULT feature was removed from synchronous scans to avoid a deadlock with McShield.exe.

To review other known and resolved VSE issues, see KB70393.

VSE 8.8 Patch 16 is the latest patch available from the Downloads tab on the ServicePortal at https://support.mcafee.com/downloads.

NOTE: VSE 8.8 Patch 16 supports all supported Windows operating systems.

Workaround

Set werfault.exe as a Low-Risk process with the scanning set to OFF.

For instructions on how to create low-risk and high-risk process exclusions for VSE 8.x in ePolicy Orchestrator, see KB67544.

Affected Products

Known Issue/Product Defect
VirusScan Enterprise 8.8

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Japanese
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Citrix Server becomes unresponsive because of a deadlock with the process werfault.exe and McShield

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

Citrix Server becomes unresponsive because of a deadlock with the process werfault.exe and McShield

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title