cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

HIPS 8 Patch 2 - Signature 6015 Blocking Outlook.exe

Jump to solution

Is anyone else having problems with signature 6015 since upgrading to HIPS 8 Patch 2?  On my test system, I have found that as soon as I install Patch 2, signature 6015 goes nuts, blocking Outlook.exe, communicator.exe (Office Communicator), and rundll32.exe.  Outlook and OCS don't even start; this signature blocks them as soon as they are invoked.

I have tried making exceptions for these, but so far nothing works, and they just get blocked.  The only thing that has worked is unlocking the HIPS UI and disabling IPS (or disabling the signature itself).

I'm running the following:

Windows 7 32-bit

Office 2010

McAfee Agent 4.6.0.1694

HIPS 8.0.0.2239 (Patch 2)

HIPS Content 8.0.0.4634

Thanks,

DamageInc

1 Solution

Accepted Solutions
McAfee Employee ktankink
McAfee Employee
Report Inappropriate Content
Message 5 of 6

Re: HIPS 8 Patch 2 - Signature 6015 Blocking Outlook.exe

Jump to solution

HIPS Content Release Notes

December 11, 2012

8.0.0.4671

[Updated] Signature 6015: Suspicious Function Invocation - Target Address Mismatch

Description:

- Signature has been modified to reduce the false positives.

5 Replies
McAfee Employee ktankink
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: HIPS 8 Patch 2 - Signature 6015 Blocking Outlook.exe

Jump to solution

Please open a Support Request with McAfee Support.  This signature has been updated a few times for false positives, but an IPS exception should work, if you created one, which Support can review.

From the October 2012 Content Release Notes:

[Updated] Signature 6015: Suspicious Function Invocation –Target Address Mismatch

Description:

-              Signature is modified to reduce False Positive.

Reliable Contributor greatscott
Reliable Contributor
Report Inappropriate Content
Message 3 of 6

Re: HIPS 8 Patch 2 - Signature 6015 Blocking Outlook.exe

Jump to solution

they just updated it again yesterday in the HIPS content update. sounds like a real winner.

Re: HIPS 8 Patch 2 - Signature 6015 Blocking Outlook.exe

Jump to solution

GreatScott,

We just received the content update, and suddenly, we see zero events for this today.  It looks like this signature was broken in the October 2012 content release.  I can come up with no other explanation than this.  It makes absolutely no sense.

-DamageInc

McAfee Employee ktankink
McAfee Employee
Report Inappropriate Content
Message 5 of 6

Re: HIPS 8 Patch 2 - Signature 6015 Blocking Outlook.exe

Jump to solution

HIPS Content Release Notes

December 11, 2012

8.0.0.4671

[Updated] Signature 6015: Suspicious Function Invocation - Target Address Mismatch

Description:

- Signature has been modified to reduce the false positives.

Re: HIPS 8 Patch 2 - Signature 6015 Blocking Outlook.exe

Jump to solution

Thanks Kary.  It looks like you're correct.  The signature malfunctioned as a result of the October content release, but was fixed in the December release.

Member Rewards
McAfee Community rewards active and helpful members just like you. Click here to take a look at the first community members who received a special reward and were recognized by McAfee leader, Aneel Jaeel, for their participation and trusted knowledge in the community.