The Real (and Virtual) Adventures of Nathan the IT Guy

Jul 9 2009   1:52AM GMT

Mcafee 8.7i Install/Upgrade Failure



Posted by: Nathan Simon
Tags:
Error = 0×7d1 : The specified driver is invalid
event viewer
eventlog
mcafee
mcafee 8.7i
nai 8.0
nai 8.5i
service fails to start
upgrade

Okay, so you have a server/workstation and your upgrading McAfee on it manually… when installing the app, the services decide to fail to start… you see these(just below) in event viewer, what do you do? Well its pretty easy… just scroll down for the resolution…

Log Name: Application
Source: McLogEvent
Date: xxxxxxxxxxx
Event ID: 5004
Task Category: None
Level: Error
Keywords: Classic
User: SYSTEM
Computer: xxxxxxxx
Description:
Could not contact Filter Driver.
Error = 0×7d1 : The specified driver is invalid.

This issue is caused by a bad value in the registry.  Basically, in the old NAI installers, for some unknown reason, the entries in the registry point to the wrong locations, well not wrong, but imcomplete as far as the NAI 8.7i installer is concerned.

The fix? Easy.

run REGEDIT

Navigate to HKLM\System\CurrentControlSet\Services\mfebopk* then
Navigate to HKLM\System\CurrentControlSet\Services\Mfeapfk* then
Navigate to HKLM\System\CurrentControlSet\Services\Mfeavfk*

* Modify the ImagePath to be the full path to the driver– for example change:
“system32\drivers\mfebopk.sys” to “C:\Windows\System32\Drivers\mfebopk.sys”

The service should now start.

NS

 Comment on this Post

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when other members comment.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: