Hello,
We are investigating this at development level and we asume this may be a source for the random hangs / freeze / "Blue circle" one of our customer has with:
Around 800 clients W7 64BIT
ENS 10.5.2
AGENT 5.0.6
TIE 2.1.0338 (HF2) Latest Version (Combi Broker and TIE Server ON ONE Server)
DXL 3.1
DLP 11 latest HF (ONLY in DEVICEBLOCK Mode > USB)
Does ANYBODY has same errors if they:
* TURN on DEBUG Logging in the POLICY
* Open file c:\ProgramData\McAfee\Endpoint Security\Logs\AdaptiveThreatProtection_Debug.log
c:\ProgramData\McAfee\Endpoint Security\Logs\AdaptiveThreatProtection_Debug.log
Search for: "Failed to finalize reputation for file"
9/05/2017 01:29:01.250 PM mfeatp(2872.432) <SYSTEM> Orchestrator.Action.Debug: Non actionable reputation score(0) recieved for C:\WINDOWS\EXPLORER.EXE
09/05/2017 01:29:02.661 PM mfeatp(2872.3816) <SYSTEM> Remediationbl.RepairModule.Debug: Obtained hash information for raptor, path c:\windows\explorer.exe md5 38ae1b3c38faef56fe4907922f0385ba
09/05/2017 01:29:05.435 PM mfeatp(2872.1956) <SYSTEM> Orchestrator.JCM.Debug: JCM system event scan for process C:\WINDOWS\SYSTEM32\DLLHOST.EXE pid 852
09/05/2017 01:29:05.436 PM mfeatp(2872.5352) <SYSTEM> Orchestrator.JCM.Debug: Process C:\WINDOWS\SYSTEM32\DLLHOST.EXE reputation 99 final 0 result 0x00000000 flags 0x0000000001000000 type: 1 connectivity: 1
09/05/2017 01:29:05.474 PM mfeatp(2872.5352) <SYSTEM> Orchestrator.JTI.Debug: Process C:\WINDOWS\SYSTEM32\DLLHOST.EXE JTI reputation 99 rule 55 threat name JTI/Trusted.65591!a8edb86fc2a4 , JCM reputation 99, IsFinal 0
09/05/2017 01:29:05.979 PM mfeatp(2872.1748) <SYSTEM> Orchestrator.JCM.Debug: Process C:\WINDOWS\SYSTEM32\DLLHOST.EXE reputation 99 final 0 result 0x00000000 flags 0x0000000001000000 type: 1 connectivity: 1
09/05/2017 01:29:09.838 PM mfeatp(2872.5656) <SYSTEM> Orchestrator.JCM.Debug: JCM system event scan for process C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\WINWORD.EXE pid 808
09/05/2017 01:29:09.839 PM mfeatp(2872.5352) <SYSTEM> Orchestrator.JCM.Debug: Process C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\WINWORD.EXE reputation 99 final 0 result 0x00000000 flags 0x0000000001000000 type: 1 connectivity: 1
09/05/2017 01:29:10.339 PM mfeatp(2872.5352) <SYSTEM> Orchestrator.Action.Debug: Orchestrator finalizing reputation for C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\WINWORD.EXE
09/05/2017 01:29:10.339 PM mfeatp(2872.5352) <SYSTEM> Orchestrator.JCM.Error: Failed to finalize reputation for file C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\WINWORD.EXE. ErrorCode 0xc030002f (For random EXE Like explorer.exe even cmd.exe)
09/05/2017 01:29:10.488 PM mfeatp(2872.432) <SYSTEM> Orchestrator.JTI.Debug: Async: Process C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\WINWORD.EXE JTI reputation 99 rule 0 threat name , JCM reputation 99, IsFinal 0
09/05/2017 01:29:10.489 PM mfeatp(2872.432) <SYSTEM> Orchestrator.Action.Debug: Orchestrator finalizing reputation for C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\WINWORD.EXE
09/05/2017 01:29:10.866 PM mfeatp(2872.2868) <SYSTEM> Orchestrator.JCM.Debug: Process C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE14\WINWORD.EXE reputation 99 final 0 result 0x00000000 flags 0x0000000001000000 type: 1 connectivity: 1
09/05/2017 01:29:14.799 PM mfeatp(2872.1956) <SYSTEM> Orchestrator.JCM.Debug: JCM system event scan for process C:\WINDOWS\SYSTEM32\DLLHOST.EXE pid 8148
Hi,
Meanwhile waiting for 10.5.4... oh wait 
"Currently there is no further information available regarding the fix release data"
Errors in ENS Error log: 01/19/2018 08:19:27.812 AM mfeatp(3984.7780) <SYSTEM> Orchestrator.JCM.Error (jcm_native.cpp:911): Failed to finalize reputation for file C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE16\WINWORD.EXE. ErrorCode 0xc030002f 01/19/2018 08:21:16.037 AM mfeatp(3984.7780) <SYSTEM> Orchestrator.JCM.Error (jcm_native.cpp:911): Failed to finalize reputation for file C:\PROGRAM FILES (X86)\MICROSOFT OFFICE\OFFICE16\EXCEL.EXE. ErrorCode 0xc030002f 01/19/2018 08:21:34.724 AM mfeatp(3984.7780) <SYSTEM> Orchestrator.JCM.Error (jcm_native.cpp:911): Failed to finalize reputation for file C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER 2017\READER\ACRORD32.EXE. ErrorCode 0xc030002f 01/19/2018 08:21:41.178 AM mfeatp(3984.7780) <SYSTEM> Orchestrator.JCM.Error (jcm_native.cpp:911): Failed to finalize reputation for file C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE. ErrorCode 0xc030002f are probably related to a known cosmetic issue which we are already working on: In cases as in these logs we see indicators of the file reputation not finalizing, often for trusted files, such as iexplore.exe, whereby we had a reputation of 99 but still failed to finalize which is indicative of a problem in JCMCore where the reputation should have already been finalized, but for some reason has not. We are already aware of this issue and investigation is ongoing. Currently there is no further information available regarding the fix release data.
