cancel
Showing results for 
Search instead for 
Did you mean: 
bramk1
Level 7

HIPS 7, signature file april 4298 causing error on Windows 2000

We're currently investigating together with McAfee a problem that popped up since last week only on windows 2000 sp4 in combination with HIPS 7.0.0.976. XP does not have the problem.

Perhaps some others have the same issue or ideas?

after login the following message appears on screen en logs in the system evenlog (approx 10 times)

Source: Application Popup Event ID: 26 description: Application popup: services.exe - Entry Point Not Found: The procedure entry point DecodePointer could not be located in the dynamic link library KERNEL32.dll

If you disable IPS by policy the message is not present. This issue is since the new signature file 4298.

Upgrade to the latest patch level 9 did not solve it. I see no traces yet in logging of hips that could point to a cause..

0 Kudos
11 Replies
Babysun
Level 7

Re: HIPS 7, signature file april 4298 causing error on Windows 2000

exactly the same issue. i'm going to open a SR to platinum support

0 Kudos
McAfee Employee

Re: HIPS 7, signature file april 4298 causing error on Windows 2000

Please see:

KB75135 -

"Procedure entry point DecodePointer could not be located in the dynamic link library" errors on Host IPS April Security Content 4298

0 Kudos
HerbSmith
Level 9

Re: HIPS 7, signature file april 4298 causing error on Windows 2000

Just search the Knowledge base for that KB,  search turned up no results.   The SNS Alert also was just a vague as this message.  

Thanks

Herb Smith

0 Kudos
bgable
Level 11

Re: HIPS 7, signature file april 4298 causing error on Windows 2000

Just pulled it up...

search for KB75135

There is an attached content remediation package if you need to check that in.

We expect to post new content to public updater some time Monday.

0 Kudos
HerbSmith
Level 9

Re: HIPS 7, signature file april 4298 causing error on Windows 2000

Thanks,   the link started working a few minutes after I posted.

I have the patch and have applied the new content that restores the old content.

It impacted just one server here,  but it was biggie.   Another higly visable event for me to deal with.

Thanks

0 Kudos
HerbSmith
Level 9

Re: HIPS 7, signature file april 4298 causing error on Windows 2000


I have installed the patch into the repository.   I presume that my nightly pulls of content from McAfee into my repository will not over write this  and put me back at 4298

Herb Smith

0 Kudos
McAfee Employee

Re: HIPS 7, signature file april 4298 causing error on Windows 2000

Hi Herb.  Which branch did you check it into?  If you put the content into Evaluation, then make sure your Repository Pull server task doesn't pull HIPS content into the Evaluation branch (default config is to the Current branch). 

Make sure your Pull task is not setup to pull content into the same branch you are using for this content package, and also make sure that the task is using the Move existing package to Previous branch option.  If you are using the Evaluation branch, you should be good.

0 Kudos
HerbSmith
Level 9

Re: HIPS 7, signature file april 4298 causing error on Windows 2000

Pushed it into all three.   Will push the update to every one.   Then sort stuff out on Monday.

I will disable the pull of hips for the weekend.

Thanks

0 Kudos
HerbSmith
Level 9

Re: HIPS 7, signature file april 4298 causing error on Windows 2000

As of 7:15 on Saturday 4-14 a search for the KB article via the platinum portal still fails.   I can find it via the links here or with a Google search.  Not good.

Second.   The fix for rolling back content is not taking.  It is in my repositories.  The agent log is showing that the attempt to update to content 4302 is failing.  I see the normal messages in the Agent Log file and then a message update failed.

This is seriously impacting us

Herb Smith

0 Kudos