Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

McAfee Endpoint Encryption v4.1.1.150 incompatible with Carbon Black Enterprise Response Sensor

McAfee Endpoint Encryption v4.1.1.150 incompatible with Carbon Black Enterprise Response Sensor

Version
This solution applies to all Carbon Black Enterprise Response Sensor versions, and specifically McAfee Endpoint Encryption for Files and Folders (EEFF) v4.1.1.150.


Issue

With both a Cb Response Sensor and McAfee Endpoint Encryption for Files and Folders v4.1.1.150 product installed on a Windows host, the system will hang on reboot.

Cause
The cause of the issue is a bug in McAfee's EEFF v4.1.1.150 MfeEEFF.sys driver causing deadlock.  The minifilter driver's calls from the InstanceSetupCallback routine result in a kernel ERESOURCE thread deadlock, which causes the system boot hanging symptom.

Solution

The solution is to remove the McAfee EEFF product.  Then reboot the system to confirm the symptom is resolved and system boot is successful.

Important Note

It is unclear if the latest version of the McAfee EEFF product resolves this issue.

Tags (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎02-26-2016
Views:
1104