Performance issues experienced by MOVE AV Multi-Platform after you upgrade Endpoint Security Threat Prevention

Technical Articles ID: KB91641
Last Modified: 2023-02-07 16:36:00 Etc/GMT

Environment

Endpoint Security Threat Prevention (ENS) 10.6.x
MOVE Antivirus Multi-Platform (MOVE AV Multi-Platform) 4.8.0

Problem

MOVE clients connected to an affected Security Virtual Machine (SVM) experience degraded performance of applications or the entire system.

Examination of the mvserver and mvagent logs reveals the following errors:

mvserver
U.7164.5396: <date>:13:25:22.859:   ERROR: avs_amcore_scanner.cpp: 291: AVScannerSetCallbacks failed with error = -1477179390.
U.7164.2432: <date>:13:55:57.213:   ERROR: avs_amcore_scanner.cpp: 1417: Apply OSS settings Failed to Begin Update.error = -1477179136

mvagent

K.1636.1664: <date>:13:25:25.548:   ERROR: scan.c : 2641: Failed to get final resp from srv_conn FFFFFA83069015B0 svm. err 0x6c

First failure to connect:

K.1636.1664: <date>:13:30:42.001:   ERROR: ivmc.c : 438: ivmc_recv failed(STATUS_TIMEOUT) with error 0xc00000b5
K.1636.1664: <date>:13:30:42.001:   ERROR: scan.c : 1986: Failed to get resp from svm. err: [0xc00000b5] = [-1073741643].
K.1636.1664: <date>:13:30:42.001:   ERROR: scan.c : 2844: Failed to send CKSUM msg id. err: -1073741643
K.1636.1664: <date>:13:30:42.001:   ERROR: scan.c : 4712: scan_file_with_file_transfer failed for file \Device\HarddiskVolume2\ProgramData\McAfee\Agent\DB\ma.db-journal: error -1073741643
U.1720.1220: <date>:13:31:27.003:   SYSTEM: evt.c : 1226: A thread in process 'masvc.exe', took more than '45000' ms while scanning file 'C:\ProgramData\McAfee\Agent\DB\ma.db-journal' (accessed by User: 'NT AUTHORITY\SYSTEM'). The file was 'allowed access'....

NOTE: These log entries have been truncated. Attached to the article is a file containing the complete sequence of events logged in both logs.

System Change

You upgraded ENS on the MOVE AV Multi-Platform scanning server.

Cause

The mcshieldclient.dll file that is on the MOVE server differs from the one being used by ENS. The mcshieldclient.dll file on the MOVE server is located in the install folder C:\Program Files (x86)\McAfee\MOVE AV Server.

The version ENS uses is in C:\Program Files\McAfee\Endpoint Security\Threat Prevention\AMCore\x86. The difference in the file versions is indicative of an ENS upgrade that has taken place and the cause of this issue.

NOTE: MOVE uses the 32-bit version of mcshieldclient.dll.

Solution

MOVE AV Multi-Platform 4.8.1 resolves this issue.

Issue resolutions in updates and major releases are cumulative; Technical Support recommends that you install the latest version. To find the most recent release for your product, go to the Product Downloads site.

Our product software, upgrades, maintenance releases, and documentation are available on the Product Downloads site.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Workaround

Restart the MOVE Server (SVM) or restart the MOVE service. The restart forces the new mcshieldclient.dll file to load.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Performance issues experienced by MOVE AV Multi-Platform after you upgrade Endpoint Security Threat Prevention

Environment

Problem

System Change

Cause

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Performance issues experienced by MOVE AV Multi-Platform after you upgrade Endpoint Security Threat Prevention

Environment

Problem

System Change

Cause

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title