McAfee 8.7i (McShield) Fails to Start with Event ID 5004

KB ID 0000023 Dtd 12/02/09

Problem

With McAfee 8.7i the on access scanner fails to start, and while attempting to start the service manually the process fails with the following error,

Event Type: Error
Event Source: McLogEvent
Event Category: None
Event ID: 5004
Date: 10/02/2009
Time: 15:38:54
User: NT AUTHORITYSYSTEM
Computer: WARDEN
Description:
Could not contact Filter Driver.
Error = 0x7d1 : The specified driver is invalid.

Solution

1. Click Start > run > Regedit {enter}
2. Navigate to HKLMSystemCurrentControlSetServices
3. Locate the mfebopk sub key
4. In the right hand window locate the ImagePath key
5. Change the entry from “system32driversmfebopk.sys” to C:WindowsSystem32Driversmfebopk.sys”
6. Repeat the procedure with both of the following Keys

HKLMSystemCurrentControlSetServicesmfeapfk
HKLMSystemCurrentControlSetServicesmfeavfk

For each one replace the path to the file with the full path (Usually adding c:windows to the beginning).

Related Articles, References, Credits, or External Links

NA

Author: Migrated

Share This Post On