McAfee (McShield) Fails to Start with Event ID 5004

KB ID 0000023

Problem

With McAfee 8.7i the on access scanner fails to start, and while attempting to start the service manually the process fails with the following error,

Event Type: Error
Event Source: McLogEvent
Event Category: None
Event ID: 5004
Date: 10/02/2009
Time: 15:38:54
User: NT AUTHORITYSYSTEM
Computer: WARDEN
Description:
Could not contact Filter Driver.
Error = 0x7d1 : The specified driver is invalid.

Solution

1. Click Start > run > Regedit {enter}
2. Navigate to HKLMSystemCurrentControlSetServices
3. Locate the mfebopk sub key
4. In the right hand window locate the ImagePath key
5. Change the entry from “system32driversmfebopk.sys” to C:WindowsSystem32Driversmfebopk.sys”
6. Repeat the procedure with both of the following Keys

HKLMSystemCurrentControlSetServicesmfeapfk
HKLMSystemCurrentControlSetServicesmfeavfk

For each one replace the path to the file with the full path (Usually adding c:windows to the beginning).

Related Articles, References, Credits, or External Links

NA

Author: Migrated

Share This Post On