McAfee 8.7i, Error = 0×7d1 : The specified driver is invalid

In McAfee 8.7i, there is an issue where the McAfee Shield disabled itself and refused to start.

In event viewer I get two errors, the first:
—————————————————————————————————————–

Log Name: Application
Source: McLogEvent
Date: xxxxxxxxxxx
Event ID: 5004
Task Category: None
Level: Error
Keywords: Classic
User: SYSTEM
Computer: xxxxxxxx
Description:
Could not contact Filter Driver.
Error = 0×7d1 : The specified driver is invalid.
—————————————————————————————————————–

the second event shows McAfee started successfully:
—————————————————————————————————————–

Event ID: 5000

McShield service started.
Engine version : 5300.2777
DAT version : 5399.0000

Number of signatures in EXTRA.DAT : None
Names of threats that EXTRA.DAT can detect : None
—————————————————————————————————————–

This issue is caused by a bad value in the registry. This error also prevents repairing the application and will generate an Error 1920: Service McAfee McShield (McShield) failed to start.

The fix to this issue is to modify several registry keys:

1. run REGEDIT
2. Navigate to HKLM\System\CurrentControlSet\Services\[mfebopk, mfeapfk, mfeavfk]
3. Modify the ImagePath to be the full path to the driver– for example change:
“system32\drivers\mfebopk.sys” to “C:\Windows\System32\Drivers\mfebopk.sys”
4. The service should now start. Alternately you can goto add remove programs and run a repair which should also fix this issue.

Feel free to add comments for others encountering this issue.

2 thoughts on “McAfee 8.7i, Error = 0×7d1 : The specified driver is invalid

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s