Having set up a new PC and installed McAfee VirusScan Enterprise 8.7i (with or without Patch 1) every so often on different setups we find that it fails to start and reports the On Access Scan / Buffer Protection and Access Protection components are disabled. This failure to start is after rebooting the PC once the application has been installed.
If you check the McAfee services all are started except the McAfee McShield service which although is on Automatic fails to start.
Then checking Event Log we see the following error on the Vista PC’s:
Log Name: Application
Event ID: 5004
Could not Contact Filter Drive. Error = 0x7d1 : The specified driver is invalid.
To fix the above we found making the below changes to some registry keys did the trick.
1) Open Regedit
2) Navigate to HKLM\SYSTEM\CurrentControlSet\Services\
3) Find the ImagePath key for mfeapfk, mfeavfk and mfebopk
4) Edit the ImagePath to reflect the full path to the .sys file – this is usually just a case of adding c:\windows\ in front of the path.
5) Make this change for the 3 listed McAfee keys (mfeapfk/mfeavfk/mfebopk)
6) Start the McAfee McShield service