Loading...

Knowledge Center

Citrix Server becomes unresponsive because of a deadlock with the process werfault.exe and McShield
Technical Articles ID:   KB89922
Last Modified:  11/13/2017

Environment

McAfee VirusScan Enterprise (VSE) 8.8 with or without Patch 1 to 9

Microsoft Windows Server 2008 R2 (x64)
Microsoft Citrix Server (Terminal Services or Citrix virtualization infrastructure)

For details of VSE supported environments, see KB51111.

Problem

Users cannot access the Citrix Server using the Remote Desktop Protocol (RDP).

The Citrix Server randomly enters into a completely unresponsive state.

A trace reports the following:
Error walking the list of completion port threads -- trying to display partial list...
Error walking the list of completion port threads -- trying to display partial list...
Error walking large message queue -- trying to display partial list
Error querying field PortMessage.u2.s2.Type of structure nt!_KALPC_MESSAGE at

Cause

The WerFault.exe process is suspending the McShield threads. Reporting by VSE mfehidk driver to McShield is being suspended, leading to McShield being left in an intermediate state. The state of the McShield is caused by a deadlock with WerFault.

NOTE: Werfault.exe is used for windows error reporting. It is a feature that allows Microsoft to track and address errors relating to the operating system.

Solution

{VSE88P10.EN_US}

The following is extracted from the VSE 8.8 Patch 10 release notes (PD27206)

1181839 - The Microsoft WERFAULT feature was removed from synchronous scans to avoid a deadlock with McShield.exe.

To review other known and resolved VSE issues, see KB70393.

{VSE88PATCHES.EN_US}

Workaround

Set werfault.exe as a Low-Risk process with the scanning set to OFF.

For instructions on how to create low-risk and high-risk process exclusions for VSE 8.x in ePolicy Orchestrator, see KB67544.

Disclaimer

The content of this article originated in English. If there are differences between the English content and its translation, the English content is always the most accurate. Some of this content has been provided using Machine Translation translated by Microsoft.

Rate this document

Did this article resolve your issue?

Please provide any comments below

Languages:

This article is available in the following languages:

English United States
Japanese

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.