Citrix Server becomes unresponsive because of a deadlock with the process werfault.exe and McShield

技術的な記事 ID: KB89922
最終更新: 1/29/2020

環境

McAfee VirusScan Enterprise (VSE) 8.8 with or without Patch 1–9

Microsoft Windows Server 2008 R2 (x64)
Microsoft Citrix Server (Terminal Services or Citrix virtualization infrastructure)

For details of VSE supported environments, see KB51111.

問題

Users can't access the Citrix Server using the Remote Desktop Protocol (RDP).

The Citrix Server randomly enters into an unresponsive state.

A trace reports the following:

Error walking the list of completion port threads -- trying to display partial list...
Error walking the list of completion port threads -- trying to display partial list...
Error walking large message queue -- trying to display partial list
Error querying field PortMessage.u2.s2.Type of structure nt!_KALPC_MESSAGE at

原因

The WerFault.exe process is suspending the McShield threads. Reporting by VSE mfehidk driver to McShield is suspended, which leads to McShield being left in an intermediate state. The state of the McShield is caused by a deadlock with WerFault.

NOTE: The werfault.exe is used for windows error reporting. It is a feature that allows Microsoft to track and address errors relating to the operating system.

解決策

This issue is resolved in VirusScan Enterprise 8.8 Update 10, which is available from the Product Downloads site at: https://www.mcafee.com/enterprise/en-us/downloads/my-products.html.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download Enterprise product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Updates are cumulative; Technical Support recommends that you install the latest one.

The following is extracted from the VSE 8.8 Patch 10 release notes:

1181839 - The Microsoft WERFAULT feature was removed from synchronous scans to avoid a deadlock with McShield.exe.

To review other known and resolved VSE issues, see KB70393.

VSE 8.8 Patch 16 is the latest patch available from the Downloads tab on the ServicePortal at https://support.mcafee.com/downloads.

NOTE: VSE 8.8 Patch 16 supports all supported Windows operating systems.

回避策

Set werfault.exe as a Low-Risk process with the scanning set to OFF.

For instructions on how to create low-risk and high-risk process exclusions for VSE 8.x in ePolicy Orchestrator, see KB67544.

影響を受ける製品

Known Issue/Product Defect
VirusScan Enterprise 8.8

言語:

この記事は、次の言語で表示可能です:

English United States
Spanish Spain
French
Japanese
Portuguese Brasileiro

技術用語集

用語集にある用語をハイライトする

当社の技術用語集を参照してください。

Knowledge Center

Citrix Server becomes unresponsive because of a deadlock with the process werfault.exe and McShield

環境

問題

原因

解決策

回避策

影響を受ける製品

言語:

技術用語集

Title

Title

Knowledge Center

Citrix Server becomes unresponsive because of a deadlock with the process werfault.exe and McShield

環境

問題

原因

解決策

回避策

影響を受ける製品

言語:

技術用語集

地域を選択してください

Title

Title