McAfee 8.7i (McShield) Fails to Start with Event ID 5004

KB ID 0000023 Dtd 12/02/09


With McAfee 8.7i the on access scanner fails to start, and while attempting to start the service manually the process fails with the following error,

Event Type: Error Event Source: McLogEvent Event Category: None Event ID: 5004 Date: 10/02/2009 Time: 15:38:54 User: NT AUTHORITYSYSTEM Computer: WARDEN Description: Could not contact Filter Driver. Error = 0x7d1 : The specified driver is invalid.


1. Click Start > run > Regedit {enter} 2. Navigate to HKLMSystemCurrentControlSetServices 3. Locate the mfebopk sub key 4. In the right hand window locate the ImagePath key 5. Change the entry from “system32driversmfebopk.sys” to C:WindowsSystem32Driversmfebopk.sys” 6. Repeat the procedure with both of the following Keys

HKLMSystemCurrentControlSetServicesmfeapfk HKLMSystemCurrentControlSetServicesmfeavfk

For each one replace the path to the file with the full path (Usually adding c:windows to the beginning).

Related Articles, References, Credits, or External Links


Author: Migrated

Share This Post On