Logon Error, GDIPLUS.DLL

[LT2C]

After Windows Update  KB4457145 (https://support.microsoft.com/ca-es/help/4457145/windows-7-update-kb4457145), users can't logon on endpoints.

When user logon, appears windows Popup (Explorer.exe) with error and logon not continues.

Solidcore Event

User.Init

• Deny Reason: Local Whitelist- File not present in whitelist
• Description: Application Control blocked this file because it is not whitelisted. To execute this file, add the file to the whitelist.
• Event Display Name: Execution Denied
• Event File Name: C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24234_none_5c05ea59a00ef565\GdiPlus.dll
• Parent Process Name: C:\Windows\System32\userinit.exe
• Performed By: UserXXXX
• Process Name: C:\Windows\explorer.exe

Other error reported

• Deny Reason: Local Whitelist- File not present in whitelist
• Description: Application Control blocked this file because it is not whitelisted. To execute this file, add the file to the whitelist.
• Event Display Name: Execution Denied
• Event File Name: C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24234_none_5c05ea59a00ef565\GdiPlus.dll
• Parent Process Name: C:\Windows\System32\services.exe
• Performed By: NT AUTHORITY\SERVICIO LOCAL
• Process Name: C:\Windows\System32\taskhost.exe

Software Version:

• ePolicy Orchestrator 5.9.1
• Mcafee Application Control  ( 8.0.0.855, 8.0.1.223 )

PD: Sorry for my English Level.

[BEllis]

What extension version are you running? 

Please make sure you have the latest 8.0.2 extension and client and make sure the windows update rule group is assigned to the machine.

[LT2C]

Hi Benjamin,

We're running Solidcore 8.2.0.126 extension and Solidcore 8.2.0.140 client.

The default Windows Update rule is assigned to the workstations.

[BEllis · Accepted solution]

Please open a case with support then and provide a gatherinfo, with the details still in the logs.

[wouterr]

same issue here on GDIPLUS.DLL and comctl32.dll.

As far as i am aware from our support ticket, engineering is aware of this issue.

For now best you can do is add these files as trusted binary on hash.

[Majidkhan]

We have the latest Solidcore version and windows rule in place and still noticing the same error

Threat Target File Path: C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24356_none_5c07bd39a00d5ba6\GdiPlus.dll

Event Category: Application Blocked

Please suggest

[BEllis]

Did you resolidify after upgrading to 8.2.1.143? 

If not you need to resolidify

[wouterr]

Also make sure you manually update update your policy as described in the releasenotes.

Especially the skiplist rule on the "\windows\winsxs\temp" folder should be removed from the Application Control > Windows > McAfee Exclusion Filters and Application Control > Windows > Windows Update rule groups

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/28000/PD28228/en_US/...