Third-party software prevents mfenlfk.sys from being installed

Technical Articles ID: KB90111
Last Modified: 1/26/2022

Environment

Endpoint Security (ENS) 10.x
Management for Optimized Virtual Environments Antivirus Multi-platform (MOVE AV MP) 4.8.x
VirusScan Enterprise (VSE) 8.8

Check Point VPN
Check Point ZoneAlarm
Shrewsoft VPN Client

Problem

When certain third-party software is installed on the system, installation of ENS, VSE, or MOVE AV MP fails. The failure can occur via an ePolicy Orchestrator deployment, or local installation.

The third-party software known to cause this issue is listed in the Environment field of this article.

From the McAfee_Endpoint_Bootstrapper_<timestamp>.log:

14/11/2017 18:03:31.921 [8672] [BootStrapperMain] Started installing Dependencies
14/11/2017 18:03:31.937 [8672] [BootStrapperMain] Installing Common 3178.1
14/11/2017 18:03:34.453 [8672] [BootStrapperMain] C:\ProgramData\McAfeeTmpInstall_Common\setupCC.exe /qn INSTALLDIR="C:\Program Files\McAfee\Endpoint Security" /ignore /norestart
14/11/2017 18:04:16.394 [8672] [BootStrapperMain] Install failed return code : 4294967295
14/11/2017 18:04:16.534 [8672] [BootStrapperMain] [ERROR]: Dependency Installation Failed. Dependency :Common
14/11/2017 18:04:16.534 [8672] [BootStrapperMain] Modules Installation Failed
14/11/2017 18:04:16.534 [8672] [BootStrapperMain] Exiting Installation.

From the McAfee_Common_VSCore_Install_All_<timestamp>.log:

[10:21:54:730] - Creating AAC policy to allow NDIS Install

[10:21:54:745] - Installing mfe_ndisfilt...
[10:21:55:101] - NDISInstall returned hr=80070005
[10:21:55:101] - Got failure, reverting changes
...
[10:21:55:322] - Removing AAC policy to allow NDIS Install/Uninstall
[10:21:55:333] - CNdisInstaller::Iinstall() hr=80070005
[10:21:55:333] - WARNING: Could not open BehaviorBlocking key
[10:21:55:334] - Lock Service DACL mfenlfk
[10:21:55:334] - InstallCustomDriver failed
[10:21:55:334] - mfenlfk.sys is not installed properly
[10:21:55:334] - parseDriver: exit=0
[10:21:55:334] - ERROR: parseFeature: Failed to parse element [Driver]
[10:21:55:334] - parseFeature: exit=0
[10:21:55:334] - ERROR: parseCoreInstall: Failed to parse element [Feature]!
[10:21:55:334] - parseCoreInstall: return=0
[10:21:55:334] - ParseXMLFile: ERROR: parseCoreInstall returned failure
[10:21:55:334] - ParseXMLFile: return=0
[10:21:55:334] - Install error: un-winding install

Cause

ENS, VSE, and MOVE AV MP use the Network Driver Interface Specification (NDIS) filter driver. The third-party software places a lock on the NDIS filter driver. The lock prevents changes that are needed for product functionality.

Solution

If you experience the issue with Check Point VPN, there's a hotfix available from Check Point that resolves the issue. For more information, see this Check Point article.

Workaround

Disable the conflicting third-party software services during the installation of ENS, VSE, or MOVE AV MP.

Affected Products

Endpoint Security Firewall 10.7.x
Endpoint Security Firewall 10.6.x
Endpoint Security Threat Prevention 10.7.x
Endpoint Security Threat Prevention 10.6.x
Endpoint Security Web Control 10.7.x
Endpoint Security Web Control 10.6.x
Install/Uninstall
MOVE Antivirus Multi-platform 4.8.x
VirusScan Enterprise 8.8 (EOL)

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Knowledge Center

Third-party software prevents mfenlfk.sys from being installed

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Third-party software prevents mfenlfk.sys from being installed

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title