The Real (and Virtual) Adventures of Nathan the IT Guy » event viewer http://itknowledgeexchange.techtarget.com/information-technology Tue, 21 May 2013 19:15:30 +0000 en-US hourly 1 Mcafee 8.7i Install/Upgrade Failure http://itknowledgeexchange.techtarget.com/information-technology/mcafee-87i-installupgrade-failure/ http://itknowledgeexchange.techtarget.com/information-technology/mcafee-87i-installupgrade-failure/#comments Thu, 09 Jul 2009 01:52:30 +0000 Nathan Simon http://itknowledgeexchange.techtarget.com/information-technology/mcafee-87i-installupgrade-failure/ Okay, so you have a server/workstation and your upgrading McAfee on it manually… when installing the app, the services decide to fail to start… you see these(just below) in event viewer, what do you do? Well its pretty easy… just scroll down for the resolution…

Log Name: Application
Source: McLogEvent
Date: xxxxxxxxxxx
Event ID: 5004
Task Category: None
Level: Error
Keywords: Classic
User: SYSTEM
Computer: xxxxxxxx
Description:
Could not contact Filter Driver.
Error = 0×7d1 : The specified driver is invalid.

This issue is caused by a bad value in the registry.  Basically, in the old NAI installers, for some unknown reason, the entries in the registry point to the wrong locations, well not wrong, but imcomplete as far as the NAI 8.7i installer is concerned.

The fix? Easy.

run REGEDIT

Navigate to HKLM\System\CurrentControlSet\Services\mfebopk* then
Navigate to HKLM\System\CurrentControlSet\Services\Mfeapfk* then
Navigate to HKLM\System\CurrentControlSet\Services\Mfeavfk*

* Modify the ImagePath to be the full path to the driver– for example change:
“system32\drivers\mfebopk.sys” to “C:\Windows\System32\Drivers\mfebopk.sys”

The service should now start.

NS

]]> http://itknowledgeexchange.techtarget.com/information-technology/mcafee-87i-installupgrade-failure/feed/ 0 Always check the Event Viewer http://itknowledgeexchange.techtarget.com/information-technology/always-check-the-event-viewer/ http://itknowledgeexchange.techtarget.com/information-technology/always-check-the-event-viewer/#comments Tue, 05 May 2009 01:02:12 +0000 Nathan Simon http://itknowledgeexchange.techtarget.com/information-technology/always-check-the-event-viewer/ Whats one of the first things you should do if there is an issue with a PC or between a PC and a server? Check the obvious, then check the event viewer. If you don’t you can find yourself in a situation where you waste a lot of time looking for a solution when it will only come to you if you get the error message from event viewer… as with a client, SMB/Shares/Printing was all inaccessible from the server. I dropped the PC from the domain, re-added it, deleted the share, readded it, nothing seemed to work. But if I would have just checked the event logs I would have seen that it was a time issue between the server and workstation! Ah well we all say that hindsight is 20/20!

]]> http://itknowledgeexchange.techtarget.com/information-technology/always-check-the-event-viewer/feed/ 0