In McAfee 8.7i, there is an issue where the McAfee Shield disabled itself and refused to start.
In event viewer I get two errors, the first:
Log Name: Application
Event ID: 5004
Task Category: None
Could not contact Filter Driver.
Error = 0×7d1 : The specified driver is invalid.
the second event shows McAfee started successfully:
Event ID: 5000
McShield service started.
Engine version : 5300.2777
DAT version : 5399.0000
Number of signatures in EXTRA.DAT : None
Names of threats that EXTRA.DAT can detect : None
This issue is caused by a bad value in the registry. This error also prevents repairing the application and will generate an Error 1920: Service McAfee McShield (McShield) failed to start.
The fix to this issue is to modify several registry keys:
1. run REGEDIT
2. Navigate to HKLM\System\CurrentControlSet\Services\[mfebopk, mfeapfk, mfeavfk]
3. Modify the ImagePath to be the full path to the driver– for example change:
“system32\drivers\mfebopk.sys” to “C:\Windows\System32\Drivers\mfebopk.sys”
4. The service should now start. Alternately you can goto add remove programs and run a repair which should also fix this issue.
Feel free to add comments for others encountering this issue.