Blue screen when connecting smart card reader caused by mfehidk.sys

[powe]

Hi,

After updating a driver for one of our smart card readers, our clients started blue screening as soon as the reader is plugged in. The BSOD reports:

KMODE_EXCEPTION_NOT_HANDLED
What failed: mfehidk.sys

Looking up the file under C:\Windows\System32\Drivers\ i could see that it was signed by McAfee, so first i tried disabling AP, OAS and EP, but the clients still crashed. I then uninstalled Endpoint Security Threat Prevention and Endpoint Security Platform completely, after that i can connect the reader without crashing.

Versions:

• ENS Platform: 10.7.0.3199
• Threat Prevention: 10.7.0.3210
• AMCore content: 5274.0
• AMCore engine: 6600.9927
• Exploit Prevention content: 10.7.0.11855

[ZeeArhaan · Accepted solution]

Hello @powe 

Good day! thank you for your reaching out to Trellix community forum.

This issue seems to be resolved in the Trellix Endpoint Security (ENS) 10.7.0 April 2023 Update and Trellix Endpoint Security (ENS) 10.7.0 November 2022 Update.

Trellix Endpoint Security (ENS) 10.7.0 April 2023 Update
Performance ENSW-117686 Resolves a BSOD issue due to the mfehidk.sys driver.

Trellix Endpoint Security (ENS) 10.7.0 November 2022 Update

Performance ENSW-115561 Resolves an issue of system freeze caused by Mfehidk.sys driver.
Performance ENSW-115251 Resolves an issue of high CPU usage due to mfehidk.sys and mfencbdc.sys.
Performance ENSW-115922 Resolves the Blue screen of death (BSoD) error caused by mfehidk.sys.

Please upgrade your ENS to have this issue addressed.

Was my reply helpful?
If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a solution" if this reply resolves your query!

I sincerely hope this helps!

Thanks, and Regards

[powe]

Alrighty! We have an upgrade planned, I'll report back once that's done.

I was looking here to see if it was a resolved/known issue but i couldn't find anything about mfehidk.sys.

[ZeeArhaan]

Thank you for highlighting about Endpoint Security 10.x Known Issues (trellix.com) not being updated with most frequent known issues yet for sometime, off late we had quite a few issues related to performance and few other issues, hence the KB is not updated for a while, I will try to reach out to internal resources and perhaps, see if I can get that KB updated.

Although, I would strongly suggest you keep this KB handy:  https://kcm.trellix.com/corporate/index?page=content&id=KB82761

You will find release notes for every version of ENS released and if you click on the release notes link, you will be able to see all the resolved issues, and this may help you for such known issues.

Was my reply helpful?
If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a solution" if this reply resolves your query!

I sincerely hope this helps!

Thanks, and Regards

[powe]

Just got the new binaries and confirmed updating ENS solved the problem 👍