McAfee Common Framework returned error 80040154 @ 1.

[AnuragK]

Version:- VSE + ASE 8.8

I executed DAT updation through commandline i.e. mcupdate.exe /TASK {<TASK_ID>} /UPDATE
It is showing me this error 80040154.
I followed troubleshooting steps provided in link "https://kc.mcafee.com/corporate/index?page=content&id=KB57899"
SecureFrameworkFactory3.dll step showing access denied even if i tried in admin mode also its not even allowed to stop service as well.
Rest solutions not working.

Note:- if i am doing update manually after right-click on trayicon it is working fine.

Please provide solution if any.
Thank you in advance.

[chealey]

You are probably being blocked from copying into that folder by the agent self protection or access protection. You should see relevant events i.e. in your Windows Event Log. Agent Self Protection can only be disabled via ePO.

Do you get the same error if you merely run:  <C:\Program Files\McAfee\VirusScan Enterprise\mcupdate> /update

[AnuragK]

Hi Chealey,

Thank you for your response.
I have one question, what is difference between mcupdate.exe /TASK {TASK_ID} /UPDATE & mcupdate /UPDATE & which one is more reliable.

[chealey]

mcupdate /UPDATE is the regular command. I've never seen the one you've listed been used to be honest. Based on the command though, it would appear to be calling a predefined update task.

[AnuragK]

> Do you get the same error if you merely run:  <C:\Program Files\McAfee\VirusScan Enterprise\mcupdate> /update

Hi chealey,

I got same error again when i executed only mcupdate.exe /UPDATE.

[chealey]

Were you able to disable self protection and access protection to perform step 3 from the KB article?

[AnuragK]

No i am not able to disable protection so, i restart my machine in safe mode & replaced this SecureFrameworkFactory3.dll file.
 now it is showing error Framwork error fffff95b@2.

[chealey]

Which version of VSE and Agent are you running?

Framework error fffff95b@2 generally indicates that the agent processes aren't running successfully.  We had a known issue which we fixed in VSE p9 (KB88264) however another cause for this issue can be a DLL injection.

If you look at your Windows Event Log at time of the Update Task, do you see any 516/514/519 events? If so, this indicates a dll on the system which is injecting into our script deaming it un-trustworthy. With process monitor or process explorer you would be able to then identify which dll is interrupting the update process.