DAT update fails with error 5: Access is denied for Mscan64a.dll in Agent\UpdateDir\x64\

技术文章 ID: KB93230
上次修改时间: 2/11/2021

环境

McAfee Agent (MA) 5.x
McAfee VirusScan Enterprise (VSE) 8.8.x

问题

When VSE DAT is updated, it fails with UpdateDIR folder not able to delete or modify the content.

The errors below are recorded in the McScript.log file:

E #8712 ScrptExe [Call]->
E #8712 ScrptExe [Executing section RunInstallScript]->
E #8712 ScrptExe [Line 1134: RunScript dwRet = C:\ProgramData\McAfee\Agent\\Current\VSCANDAT1000\DAT\0000*\V2datinstall.mcs, ScriptMain]->*
E #8712 ScrptExe [Executing section ScriptMain]->
E #8712 ScrptExe [LoopIf]->
E #8712 ScrptExe [Executing section EnumerateThroughProducts]->
E #8712 ScrptExe [Call]->
E #8712 ScrptExe [Executing section UpdateProduct]->
E #8712 ScrptExe [CallIf]->
E #8712 ScrptExe [Executing section V2Update]->
E #8712 ScrptExe [Call]->
E #8712 ScrptExe [Executing section TestNewEngineDATsV2]->
E #8712 ScrptExe [CallIf]->
E #8712 ScrptExe [Executing section CopyEngineIfNotBeingUpdated]->
E #8712 ScrptExe [Call]->
E #8712 ScrptExe [Executing section CopyEngineV2]->
E #8712 ScrptExe [CopyFilesByMask]->
E #8712 Filer [GetFileAttributes,C:\ProgramData\McAfee\Agent\UpdateDir\x64\Mscan64a.dll]->
E #8712 Filer error 5: Access is denied. X #8712 ScrptExe ReturnIf

原因

The SYSMON64.exe Process locked the Mscan64a.dll file in the UpdateDir folder.

The Mscan64a.dll file is copied to C:\ProgramData\McAfee\Agent\UpdateDir\x64\ during the VSE DAT update, and it deletes the file after the activity is completed.

Because of some of the third-party applications, the file fails to delete and stops the DAT update. The reason is because it can't modify or overwrite the file to complete the activity.

解决方案

Perform the following steps:

Run the Process Explorer and search for UpdateDir. You can download the Process Explorer at https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer.
Verify if the Sysmon64.exe process is accessing the MScan64a.dll file.
If the Sysmon64.exe process is accessing the MScan64a.dll file, do the following:
Go to the sysmon folder using the command prompt as administrator, and run:

sysmon64.exe -u
It deletes the UpdateDir folder and VSE DAT updates successfully.

For more information about Sysmon, see https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon.

受影响的产品

McAfee Agent 5.7.x
McAfee Agent 5.6.x
VirusScan Enterprise 8.8

语言:

此文章有以下语言版本：

English United States
Japanese
Chinese Simplified

技术术语词汇表

突出显示词汇表术语

请花点时间浏览一下我们的技术术语词汇表。

Knowledge Center

DAT update fails with error 5: Access is denied for Mscan64a.dll in Agent\UpdateDir\x64\

环境

问题

原因

解决方案

受影响的产品

语言:

技术术语词汇表

Title

Title

Knowledge Center

DAT update fails with error 5: Access is denied for Mscan64a.dll in Agent\UpdateDir\x64\

环境

问题

原因

解决方案

受影响的产品

语言:

技术术语词汇表

选择您的区域

Title

Title