Problems with DIebold Win 10 ATM

[paulmccarthy]

We have a deployment with several identical Diebold ATMs.  They all behave the same way.

If we enable solidcore, we get reboots after about 30 to 60 minutes.  Always a runtime error:

Application: Connector.exe
Framework Version: v4.0.30319

We see no files blocked from loading by McAfee.  There is considerable auto updater traffic due to we have authorized this program and others to do so via "trusted -U" commands.  If we disable solidcore, no issues.

There is no other AV running, but we do note that there is this:

Symantec SHA256 Code Signing CA Certificate" Application_Date="2020-01-21,16:06:59" Application_Version="1.0.1.3" Application_Publisher="Diebold" Application_Product_ID="" Application_Path=""/>

When solidcore was installed, there was a set of Symantec events logged (IDs 34, 35, 36 and 37) but no reference to errors.  Solidcore seems to run as expected.

We try to run "sadmin diag" and get nothing back from solidcore even though "discover-updaters" is enabled.

We did discover the following in the solidcore logs, logged near a crash:

K.1032.3196: Mar 19 2020:14:25:20.667: ERROR: pst_hooks_winnt.c: 1086: Failed to mark \Device\HarddiskVolume2\Windows\System32\wups.dll loader thread as updater, name: \Device\HarddiskVolume2\Windows\System32\wups.dll,err: 17

Can you recommend a next course of action?

Thanks,

Paul McCarthy / Amy Zhang

Burroughs

[Benjamin_Ellis]

Your next course of action is to open a case with Support as this will require more than just a quick answer

[tucker84]

What version of the McAfee Agent and Solidcore do you use?

[paulmccarthy]

We are using 8.2.1.  We've made some progress on ticket 4-20835183603.  We learned the system was running Symantec when we went onsite to install McAfee.  The tech uninstalled it before installing MAC.

The support team's analysis is that some element of Symantec was still interfering with our install but we did not realize that at the time.  The case has gone cold as we no longer support the install, our customer cancelled our support service. 

Thanks,

Paul

[BenEllis]

you were looking for next steps? You state your customer cancelled your support. This requires indepth troubleshooting but you have seen this?

https://knowledge.broadcom.com/external/article/162857

https://kc.mcafee.com/corporate/index?page=content&id=KB91773