Having set up a new PC and installed McAfee VirusScan Enterprise 8.7i (with or without Patch 1) every so often on different setups we find that it fails to start and reports the On Access Scan / Buffer Protection and Access Protection components are disabled. This failure to start is after rebooting the PC once the application has been installed.

If you check the McAfee services all are started except the McAfee McShield service which although is on Automatic fails to start.

Then checking Event Log we see the following error on the Vista PC’s:
Log Name: Application
Source: McLogEvent
Event ID: 5004

Could not Contact Filter Drive. Error = 0x7d1 : The specified driver is invalid.



To fix the above we found making the below changes to some registry keys did the trick.

1) Open Regedit
2) Navigate to HKLM\SYSTEM\CurrentControlSet\Services\
3) Find the ImagePath key for mfeapfk, mfeavfk and mfebopk
4) Edit the ImagePath to reflect the full path to the .sys file – this is usually just a case of adding c:\windows\ in front of the path.


5) Make this change for the 3 listed McAfee keys (mfeapfk/mfeavfk/mfebopk)
6) Start the McAfee McShield service



  1. 15/07/2009 at 3:28 AM bdavis

    You have done what no one else could. I’ve searched McAfee’s forums as well as countless others to no avail. Thank you for this terrific post.


  2. 07/08/2009 at 2:46 PM andy

    Great !!!! Thanks a lot

  3. 14/08/2009 at 1:21 PM Neil

    Perfect fix! Many thanks.

  4. 09/09/2009 at 10:25 PM Brian

    You are my hero. This works like a charm.

  5. 07/10/2009 at 6:46 PM Tuttin

    Good stuff man. I work in IT and without help from nice folks like yourself, our jobs are impossible

  6. 03/11/2009 at 11:29 AM Vaibhav

    Thanks a lot …perfect fix !!!

  7. 19/02/2010 at 1:19 PM Charlie Spencer

    I guess I’m the only one this doesn’t work for. When I start the McShield service, it immediately goes back to a ‘Paused’ state.

  8. 25/02/2010 at 5:23 PM Cristi

    I was struggling with this error for almost a year and now i found the solution. thank you !

  9. 06/04/2010 at 4:43 PM Dan

    Charlie Spencer, if after making this registry fix McShield is still going back to Paused, try downloading and installing the latest SuperDAT from McAfee and see if that fixes it.

  10. 23/10/2010 at 3:40 PM mansoor ali

    you are so great man……

  11. 09/12/2011 at 12:51 PM MM

    Man, u were very helpful, thanks

  12. 18/03/2012 at 4:54 PM MVRamesh

    That was really a good suggestion…
    My Problemt solved.

  13. 09/07/2012 at 2:38 PM anith

    Did not work for me 🙁

  14. 02/01/2013 at 11:18 AM kirun

    Good Stuff… Thank you… Helped a lot… 🙂