cancel
Showing results for 
Search instead for 
Did you mean: 

generic application invokation or hooking rules prevent arguments from being passed

I have a an application that our users user that allows them to pick set of file names displayed by the application and then send the file or folder name to another application, such as SlickEdit as found on the  registry or default installation path and pass it the conjoined filenames  and an option via Process.Start  in the StartInfo structure which is convertible to a string. Recently our System admins (SAs) were instructed to upgrade the protections on our machines to include the 6010/6011 Host IPS protections for generic application invocation and hooking. I had one of them look at it and he was able to disable that but the arguments don't seem to be passed to SlickEdit as they used to be. What do I need to get the SAs to change?

1 Reply
Highlighted
McAfee Employee ktankink
McAfee Employee
Report Inappropriate Content
Message 2 of 2

Re: generic application invokation or hooking rules prevent arguments from being passed

Hi @JamesRinkevich, try troubleshooting with the KB below.  

KB67056 - Third-party application stops working or is impaired after McAfee Host Intrusion Prevention is installed or content is updated
https://kc.mcafee.com/corporate/index?page=content&id=KB67056

 

Additionally, the IPS Options feature "Automatically include network-facing and service-based applications in the application protection list" can cause 3rd party application issues if the HIPS DLLs are hooked into a third party app.  Disable this option, reboot the system, and retest to see if the IPS hooking causes the issue.  This is typical when the issue is resolved by disabling the Host IPS module entirely, but not when you disabling the all IPS Signatures (e..g, by setting the IPS Protection policy to IGNORE all severities).  If disabling this IPS Options feature resolves the issue, look to create an application protection exclusion in your policies for that 3rd party application executable; ref https://kc.mcafee.com/corporate/index?page=content&id=KB79850.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator