DAT update fails with error 5: Access is denied for Mscan64a.dll in Agent\UpdateDir\x64\

Technical Articles ID: KB93230
Last Modified: 2/11/2021

Environment

McAfee Agent (MA) 5.x
McAfee VirusScan Enterprise (VSE) 8.8.x

Problem

When VSE DAT is updated, it fails with UpdateDIR folder not able to delete or modify the content.

The errors below are recorded in the McScript.log file:

E #8712 ScrptExe [Call]->
E #8712 ScrptExe [Executing section RunInstallScript]->
E #8712 ScrptExe [Line 1134: RunScript dwRet = C:\ProgramData\McAfee\Agent\\Current\VSCANDAT1000\DAT\0000*\V2datinstall.mcs, ScriptMain]->*
E #8712 ScrptExe [Executing section ScriptMain]->
E #8712 ScrptExe [LoopIf]->
E #8712 ScrptExe [Executing section EnumerateThroughProducts]->
E #8712 ScrptExe [Call]->
E #8712 ScrptExe [Executing section UpdateProduct]->
E #8712 ScrptExe [CallIf]->
E #8712 ScrptExe [Executing section V2Update]->
E #8712 ScrptExe [Call]->
E #8712 ScrptExe [Executing section TestNewEngineDATsV2]->
E #8712 ScrptExe [CallIf]->
E #8712 ScrptExe [Executing section CopyEngineIfNotBeingUpdated]->
E #8712 ScrptExe [Call]->
E #8712 ScrptExe [Executing section CopyEngineV2]->
E #8712 ScrptExe [CopyFilesByMask]->
E #8712 Filer [GetFileAttributes,C:\ProgramData\McAfee\Agent\UpdateDir\x64\Mscan64a.dll]->
E #8712 Filer error 5: Access is denied. X #8712 ScrptExe ReturnIf

Cause

The SYSMON64.exe Process locked the Mscan64a.dll file in the UpdateDir folder.

The Mscan64a.dll file is copied to C:\ProgramData\McAfee\Agent\UpdateDir\x64\ during the VSE DAT update, and it deletes the file after the activity is completed.

Because of some of the third-party applications, the file fails to delete and stops the DAT update. The reason is because it can't modify or overwrite the file to complete the activity.

Solution

Perform the following steps:

Run the Process Explorer and search for UpdateDir. You can download the Process Explorer at https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer.
Verify if the Sysmon64.exe process is accessing the MScan64a.dll file.
If the Sysmon64.exe process is accessing the MScan64a.dll file, do the following:
Go to the sysmon folder using the command prompt as administrator, and run:

sysmon64.exe -u
It deletes the UpdateDir folder and VSE DAT updates successfully.

For more information about Sysmon, see https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon.

Affected Products

McAfee Agent 5.7.x
McAfee Agent 5.6.x
VirusScan Enterprise 8.8 (EOL)

Languages:

This article is available in the following languages:

English United States
Japanese
Chinese Simplified

Knowledge Center

DAT update fails with error 5: Access is denied for Mscan64a.dll in Agent\UpdateDir\x64\

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

DAT update fails with error 5: Access is denied for Mscan64a.dll in Agent\UpdateDir\x64\

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title