Third-party software prevents mfenlfk.sys from being installed

Technical Articles ID: KB90111
Last Modified: 2023-02-27 19:45:36 Etc/GMT

Environment

Endpoint Security (ENS) 10.x
MOVE Antivirus Multi-platform (MOVE AV MP) 4.8.x

Check Point VPN
Check Point ZoneAlarm
Shrewsoft VPN Client

Problem

When certain third-party software is installed on the system, installation of ENS or MOVE AV MP fails. The failure can occur during an ePolicy Orchestrator deployment or local installation.

The third-party software known to cause this issue is listed in the Environment field of this article.

From the McAfee_Endpoint_Bootstrapper_<timestamp>.log:

14/11/2017 18:03:31.921 [8672] [BootStrapperMain] Started installing Dependencies
14/11/2017 18:03:31.937 [8672] [BootStrapperMain] Installing Common 3178.1
14/11/2017 18:03:34.453 [8672] [BootStrapperMain] C:\ProgramData\McAfeeTmpInstall_Common\setupCC.exe /qn INSTALLDIR="C:\Program Files\McAfee\Endpoint Security" /ignore /norestart
14/11/2017 18:04:16.394 [8672] [BootStrapperMain] Install failed return code : 4294967295
14/11/2017 18:04:16.534 [8672] [BootStrapperMain] [ERROR]: Dependency Installation Failed. Dependency :Common
14/11/2017 18:04:16.534 [8672] [BootStrapperMain] Modules Installation Failed
14/11/2017 18:04:16.534 [8672] [BootStrapperMain] Exiting Installation.

From the McAfee_Common_VSCore_Install_All_<timestamp>.log:

[10:21:54:730] - Creating AAC policy to allow NDIS Install

[10:21:54:745] - Installing mfe_ndisfilt...
[10:21:55:101] - NDISInstall returned hr=80070005
[10:21:55:101] - Got failure, reverting changes
...
[10:21:55:322] - Removing AAC policy to allow NDIS Install/Uninstall
[10:21:55:333] - CNdisInstaller::Iinstall() hr=80070005
[10:21:55:333] - WARNING: Could not open BehaviorBlocking key
[10:21:55:334] - Lock Service DACL mfenlfk
[10:21:55:334] - InstallCustomDriver failed
[10:21:55:334] - mfenlfk.sys is not installed properly
[10:21:55:334] - parseDriver: exit=0
[10:21:55:334] - ERROR: parseFeature: Failed to parse element [Driver]
[10:21:55:334] - parseFeature: exit=0
[10:21:55:334] - ERROR: parseCoreInstall: Failed to parse element [Feature]!
[10:21:55:334] - parseCoreInstall: return=0
[10:21:55:334] - ParseXMLFile: ERROR: parseCoreInstall returned failure
[10:21:55:334] - ParseXMLFile: return=0
[10:21:55:334] - Install error: un-winding install

Cause

ENS and MOVE AV MP use the Network Driver Interface Specification (NDIS) filter driver. The third-party software places a lock on the NDIS filter driver. The lock prevents changes that are needed for product functionality.

Solution

If you experience the issue with Check Point VPN, there's a hotfix available from Check Point that resolves the issue. For more information, see this Check Point article.

Workaround

Disable the conflicting third-party software services during the installation of ENS or MOVE AV MP.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Third-party software prevents mfenlfk.sys from being installed

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Third-party software prevents mfenlfk.sys from being installed

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title