PDA

View Full Version : BSOD - mfehidk.sys - McAfee 5.0.0 engine



Starrick
16.05.2006, 15:35
I've been running Daemon Tools v 4.0.3 for several months. Yesterday it would appear that our managed AV (McAfee) installed an engine update. Since that time the two machines in the office with Daemon tools installed keep BSOD'ing on bootup.

Looking, it appears that McAfee has clobbered the sptd.sys file.

McAfee convieniently has a KBase article blaming this issue on Daemon Tools. Their recomended work-around is to un-install Daemon Tools. Convinient given it was all happy yesterday until their update loaded, but I digress.

http://knowledge.mcafee.com/SupportSite/dynamickc.do?sliceId=SAL_Public&command=show&forward=nonthreadedKC&externalId=KB47537

At any rate, I'm hoping the folks here might be able to fix/provide a better work around to this as I find Daemon Tools a very usefull tool.

I'll be submitting shots of the BSOD and minidumps shortly.

Interestingly, I'm un-installed Daemon tools in safe mode while entering this message on my laptop, and upon bootup now my AV is dead.

Copytrooper
16.05.2006, 20:14
The issue is under investigation.

dcc24
17.05.2006, 05:52
I was merilly working on my system for two hours then bam.. bsod with mfehdik.sys. I am also with McAfee Managed Virus Scan and they just forced!! all there customers to go to their Total Protection for Small Business.

Anyway, I am in safe mode as I type this. I uninstalled Daemon Tools using the uninstaller in the start menu but my machine still crashes just as McAfee is trying to turn on its real time protection.

I am going to try uninstalling McAfee and see if it lets me boot. I really need my DaemonTools. Please help soonest! Thanks :)

Jareb Coupe
17.05.2006, 14:28
Yea, there must have been an automatic update to McAfee last night. Regarding dcc24's post, it does appear that uninstalling McAfee resolves the issue (unlike his experience of uninstalling Daemon Tools).

But, alas, I'm in the same situation where we are required to use the McAfee software when connected to our company network.

I imagine that McAfee tweaked a layer of their protection, and now Daemon Tools will have to suck up and wiggle their way through to McAfee's development team just to even begin to understand what is going on, so DT can figure out a work-around (since it's obvious that McAfee won't do dick all to remedy the situation they created).

*grumbles*

Underscore
26.05.2006, 02:23
Happened to me as well. McAfee updates just rolled out with no warning and took out every computer that was running DAEMON Tools. BSOD's everywhere. There response is to blame it on DAEMON so it is no longer there problem. This is now a big clean-up job gotta fix all the machines. Uninstalling McAfee appears to be the only solution, but that is a big call. Any idea who can supply a better automated antivirus solution?

Any idea if DAEMON are going to come to the rescue and provide a fix for McAfee's mess?

Underscore
26.05.2006, 03:50
I've managed to get McAfee and DAEMON working on the same machine by excluding the files mfehidk.sys and sptd.sys from being scanned by the McAfee on-access scanner. You have to do this from the McAfee administrator web site. I uninstalled both DAEMON and McAfee then installed McAfee then set the exclusions, then installed DAEMON...so far it looks stable!

Hopefully DAEMON will supply a fix soon as I don't like having excluded files. Is there some way we can be notified when a fix is available?

PCOECSI
27.05.2006, 01:52
http://knowledge.mcafee.com/SupportSite/search.do?cmd=displayKC&externalId=KB47537&sliceId=SAL_Public
Technically this is a McAfee issue, While all McAfee's debugging may point to Daemon Tools, it is mfehidk that is causing and throwing the unhandled exception (UE) BSOD list the sys files involved in the (UE) in reverse order of the calls, apparently mfehidk attempts to interact with the Daemon Tools file in my case (vaxscsi.sys distribued by Alcohol 120%) in a mannor that is interfering with vaxscsi.sys's proper operation. Perhaps Microsoft can litigate who is at fault, I say it is McAfee by virtue of the fact that the Anti Virus is an API that hooks other applications in order to intercept potential invasions and is a Software Class Driver, Daemon Tools on the other hand is a Hardware Class Driver. Hardware Class Drivers allways take precedence over Software Class Drivers. Software Class Drivers that hook Hardware Drivers are supposed to do so in a manner that does not, nor attempts to interfere with their operation. You know how they say it "You break it... You buy it..." it is Time for McAfee to step up to the plate and eat crow... "McAfee broke it... McAfee fixes it"!

Jito463
30.05.2006, 13:21
Any idea who can supply a better automated antivirus solution?
My personal suggestion would be NOD32 (http://www.nod32.com). It's a corporate-level A-V, but they sell individual user licenses which is how I'm running it on both of my machines. And it's a small footprint. The whole download is less then 10MB.

btrombley
07.06.2006, 18:40
I'm a Product Manager at McAfee. Our VirusScan Core team engineers would like to troubleshoot this issue with Daemon Tools developers. However, none of us have any contacts at Daemon Tools. Any help would be appreciated...

Jito463
07.06.2006, 19:37
LocutusOfBorg (locutus@daemon-tools.cc) would be the best one to contact.

LocutusofBorg
07.06.2006, 19:41
@btrombley: Please contact me via our internal PM-system
here, I already messaged you and you should see the popup
after you logged in here.

Underscore
19.06.2006, 03:01
Well I've had a few emails back and forward to McAfee. They have been looking into this problem, and trying to solve it. They even came back with a solution which was thoughtful. Unfortunately, the solution disabled virus scanning on the PC so it wasn't really a solution. I even posted a fix on this forum that was supposed to solve it (excluding files from scanning). Unfortunately that appeared to work but after a while the BSOD came back.

Anyway, McAfee have come back with the final answer. They say this is a bug in Daemon Tools and there is nothing they can do to fix it. Apparently this bug is crashing all sorts of other software as well.

So what's happening Daemon Tools developers? Is McAfee right and you are working on a fix for this?

Jito463
19.06.2006, 12:24
McAfee is horrible software, in my professional opinion. What's all this "other software" that's having so many problems with Daemon Tools? I certainly haven't encountered any, and I run a lot of software. My suggestion, get NOD32 instead. Light AV that doesn't use a lot of system resources but with a very good scanner.

Underscore
19.06.2006, 22:11
I don't know which software. It was the McAfee support person who said this. I expect they are just making excuses. There does appear to be some other BSOD reports in this forum, I haven't gone through them all.

mr-b
23.06.2006, 16:24
I have just found out that I'm hitting this issue - it took several weeks for McAfee to diagnose the problem.

Their support ppl point to http://www.daemon-tools.cc/dtcc/showthread.php?t=6992&highlight=uninstall

--------------------------
Blue Screen in MFEHIDK.SYS with Daemon Tools installed

Question or Problem

Blue Screen in MFEHIDK.SYS with Daemon Tools installed.
--------------------------------------------------------------------------------
System blue screens while booting.

Solution

This issue occurs due to an interaction between Daemon Tools and the 5.0.00 Scanning Engine. Currently it has been seen with McAfee Policy Enforcer and Total Protection for Small Business. This issue can be expected for any product using the 5.0.00 and later versions of the McAfee Scanning Engine.

After analyzing multiple crash logs, McAfee has determined the cause of the issue is with Daemon Tools. Escalations for this issue will no longer be accepted by McAfee Technical Support. Customers are advised to contact Daemon Tools at http://www.daemon-tools.cc for further assistance.

--------------------------------------------------------------------------------
As a workaround, McAfee recommends removing Daemon Tools from the affected system.

Cause

This issue occurs when Daemon Tools version 4.0.3 is installed on the system.
################

So is there any update?

Underheaven
23.06.2006, 20:07
No update but the DAEMON Tools team has been contacted by McAfee.

Jito463
23.06.2006, 20:30
I think part of the problem is this site below that states this file is part of Daemon Tools, when in fact it is not. They probably just google searched for this file, saw this page (which was the top of the list when I searched) and ASSumed it was accurate. It even lists Jelsoft as the manufacturer of the file. They're the ones who sell VBulletin (see the bottom of this page if you don't believe me).

http://www.greatis.com/appdata/a/m/mfehidk.sys.htm

*EDIT*
I sent a message to them regarding this entry, explaining their moronic mistakes. Hopefully it will be updated with correct information, or removed completely.

*EDIT2*
Turns out mfehidk.sys is actually part of McAfee according to a pdf on their website. I assumed (yeah, I know) that they didn't know what the file was and was blaming it's existence on the DTools team. Odd that only their AV has issues with DTools, though.

ezra451
26.06.2006, 16:04
Ok so it doesn't do a whole lot to denigrate McAfee. It may not be the best out there but it's not the worst. Regardless, people frequently have no choice but to ruin it deopending on their corporate culture. On to the topic.

I had the same experience regarding Daemon Tools and McAfee as everyone else. What I've done until i can find a more sufficient work around is to:

boot into safe mode.
Open the Services Control Panel and disable McAfee Total Protection (MTP).
Open the registry and Remove Daemontools from RunOnce (should only be one entry)
Move C:\windows\system32\drivers\sptd.sys and sptd1005 to C:\temp
reboot
Open the Services control panel. re-enable and start the MTP service.

Now it's true that Daemon Tools has now been hobbled which of course is why I'll post again if for some reason I can beat someone else to a fix. I noticed some McAfee ExcludeItem entries in the registry but as of yet have not played with them.

McAfeeTierIII
13.07.2006, 21:00
Just to close the loop on this thread, I've confirmed that when using the latest build of Daemon Tools 4.0.3, this issue no longer occurs. Also, on the McAfee side, we've changed our driver files, to avoid the issue going forward.

I would say that both parties found better ways to accomplish their goals, and all should be well.

- McAfee Support

Underscore
13.07.2006, 22:39
yes...well done everything is sorted. It is good to see people being friendly and working together:)

bmanton
04.02.2007, 13:34
im running latest version of mcafee and DT and still getting problem... not fixed :)

enanje
27.02.2008, 20:45
This problem has nothing to do with Daemon Tools. I am having the same problem and have never used Daemon Tools on any of my servers. I have been to microsoft, got referred to McAfee and they sent me to Daemon Tools. McAfee is good at running away from problems if they are unable to resolve or research it. This is not the first time I have a bad experience with them. They must have some pretty lazy developers. If I were making the decisions, I'll go with Trend Micro instead of this McAfee crap. Do your work or take your stuff off the market.

Underheaven
28.02.2008, 22:29
This issue *was* resolved by both the McAfee and DAEMON Tools programmers last year.