We're currently investigating together with McAfee a problem that popped up since last week only on windows 2000 sp4 in combination with HIPS 22.214.171.1246. XP does not have the problem.
Perhaps some others have the same issue or ideas?
after login the following message appears on screen en logs in the system evenlog (approx 10 times)
Source: Application Popup Event ID: 26 description: Application popup: services.exe - Entry Point Not Found: The procedure entry point DecodePointer could not be located in the dynamic link library KERNEL32.dll
If you disable IPS by policy the message is not present. This issue is since the new signature file 4298.
Upgrade to the latest patch level 9 did not solve it. I see no traces yet in logging of hips that could point to a cause..
Just search the Knowledge base for that KB, search turned up no results. The SNS Alert also was just a vague as this message.
Just pulled it up...
search for KB75135
There is an attached content remediation package if you need to check that in.
We expect to post new content to public updater some time Monday.
Thanks, the link started working a few minutes after I posted.
I have the patch and have applied the new content that restores the old content.
It impacted just one server here, but it was biggie. Another higly visable event for me to deal with.
I have installed the patch into the repository. I presume that my nightly pulls of content from McAfee into my repository will not over write this and put me back at 4298
Hi Herb. Which branch did you check it into? If you put the content into Evaluation, then make sure your Repository Pull server task doesn't pull HIPS content into the Evaluation branch (default config is to the Current branch).
Make sure your Pull task is not setup to pull content into the same branch you are using for this content package, and also make sure that the task is using the Move existing package to Previous branch option. If you are using the Evaluation branch, you should be good.
Pushed it into all three. Will push the update to every one. Then sort stuff out on Monday.
I will disable the pull of hips for the weekend.
As of 7:15 on Saturday 4-14 a search for the KB article via the platinum portal still fails. I can find it via the links here or with a Google search. Not good.
Second. The fix for rolling back content is not taking. It is in my repositories. The agent log is showing that the attempt to update to content 4302 is failing. I see the normal messages in the Agent Log file and then a message update failed.
This is seriously impacting us