BSOD with mfehidk.sys ENS 10.6.1 randomly

[Daniel_S]

Hey fellas,

we are currently facing serious problems with seceral systems that mainly suffer from a BSOD after reboot - in rare conditions during normal operations.

DRIVER_IRQL_NOT_LESS_OR_EQUAL mfehdik.sys or

INACCESSIBLE BOOT DEVICE

Having a look at the KBs it seems like in most cases this is related to the updating components which make use of the syscore. In this case this would fit as the problems first occured like 1-2 weeks ago and we have the latest 5.6.1 Agent with DXL checked in and deployed.

ENS is 10.6.1 - in some cases with May update in some others with February. OS also varies from WIn7 to Win10. Latest MS Patches are from April.

However booting the systems with a livelinux / recovermedia and renaming / deleting the mfehidk.sys didn´t fix the problem and one system showed a corrupted hdd table afterwards.

The problem is not reproducable.

I still blame Exploit Prevention to be the root cause for this behaviour.

Anybody here with an idea? Is this already known to McAfee? Anyone facing the same issues?

[Former Member · Accepted solution]

Kindly submit a full memory dump and a MER from a system displaying the issue - with ENS 10.6.1 May Update installed - to our Technical Support Team for analysis.

[Daniel_S]

As we are not able to recover the systems it´s not possible.

The one system where recovery was possible, we already have reinstalled ENS - so logs would be useless.

In neither case we could find memory dumps.

Will try to get hands on another affected system to try again.

[Former Member]

That's quite a major crash though if it the system can't be recovered. I'm afraid there aren't any known issues we can make you aware of in regards to this specific crash, hence the data request.

We appreciate your efforts! 

[FA1]

According to McA Support an issue causing this error message has been fixed with the December update of ENS 10.6.1, which hence is recommended to be installed.

[Daniel_S]

This is how things turn out then.