cancel
Showing results for 
Search instead for 
Did you mean: 
damiafaw
Level 10
Report Inappropriate Content
Message 21 of 42

Re: VSE Patch 7 and HIPS Patch 7 out

So....got things talking, although once I update to latest HIPS - the tray disappears, still talking to EPO - but not showing and the policy for the agent is to show.

It also keep asking to restart after booting - this is patching from 6 to 7.

If I edit the agent policy to untick the showing of agent, wake it up and then retick, wake it up - the tray icon comes back.

However on restart, its gone again, but services still running in the background - this is Agent 5.0.2.188

I can wake the agent up from EPO - anyone know why this is appearing during install - I dont remember there being any new entries required in exclusions?

C:\PROGRAM FILES (X86)\MCAFEE\HOST INTRUSION PREVENTION\HELPER32.EXE

Threat Target File Path:

HKLM\SOFTWARE\WOW6432NODE\MCAFEE\MCTRAY\PLUGINS\HIPSPLUGIN\

Threat Name: Common Standard Protection:Prevent modification of McAfee Common Management Agent files and settings
Action Taken:deny write

The policy for HIPS fails to read from the registry also.

damiafaw
Level 10
Report Inappropriate Content
Message 22 of 42

Re: VSE Patch 7 and HIPS Patch 7 out

Installing Agent 5.0.2.333 has stopped the restart message appearing for HIPS - however no agent icon on restart (was there on install/upgrade over 188)

A restart has enabled the tray icon to come back

Back to not getting manual tasks pushed to the laptop though.

There are several entries in event viewer since VSE was possibly installed earlier stating;

Task Manager: Could not open registry keys

Anyone having issues with installing VSE or HIPS?

Re: VSE Patch 7 and HIPS Patch 7 out

Update from HIPS P6 to P7 takes far longer than I was expecting and noticably interrupts LAN connections as it goes through.

Have upgraded only a handful of VSE endpoints so far, very nervous about this as we have 85000 endpoints and the issues with P5 and P6 were horrific, especially on older server OS.

Recent updates of VSE, HIPS and CMA have been very poorly prepared and have caused significant issues and downtime for us. I expect the support bill to be hair raising.

Having read the release notes for CMA 5.0.2.333, I shall be leaving that well alone and will wait for 5.0.3. There are too many ifs and buts.

Not McAfee's finest hour and possibly the most disruptive set of update releases I have seen in the last 15 years of using the product set.

Re: VSE Patch 7 and HIPS Patch 7 out

While doing some manual testing with Patch7 the following issue was present which actually prevents an install attempt, the error claims the Mcafee Agent version is not supported.  The agent version is currently 5.0.2.132 and the installer fails claiming the agent version is not supported in Patch 7.


I can see from the installer content that Agent 4.8 is present within the package files but this is no longer in use within our Mcafee EPO infrastructure and reverting back to the 32bit agent is a no go.


Config;

EPO version 5.3.1
Mcafee Agent versions in use 5.0.2.132

Current Windows VSE version - 8.8.0.1445

Output of the MSI installer log

MSI (c) (D0:3C) [10:52:38:491]: Windows Installer installed an update. Product Name: McAfee VirusScan Enterprise. Product Version: 8.8.07000. Product Language: 2057. Manufacturer: McAfee, Inc.. Update Name: McAfee VirusScan Enterprise 8.8 Patch 7. Installation success or error status: 1603.

MSI (c) (D0:3C) [10:52:38:491]: Note: 1: 1729

MSI (c) (D0:3C) [10:52:38:491]: Transforming table Error.

MSI (c) (D0:3C) [10:52:38:491]: Transforming table Error.

MSI (c) (D0:3C) [10:52:38:491]: Note: 1: 2262 2: Error 3: -2147287038

MSI (c) (D0:3C) [10:52:38:491]: Transforming table Error.

MSI (c) (D0:3C) [10:52:38:491]: Transforming table Error.

MSI (c) (D0:3C) [10:52:38:491]: Note: 1: 2262 2: Error 3: -2147287038

MSI (c) (D0:3C) [10:52:38:507]: Product: McAfee VirusScan Enterprise -- Configuration failed.

MSI (c) (D0:3C) [10:52:38:507]: Windows Installer reconfigured the product. Product Name: McAfee VirusScan Enterprise. Product Version: 8.8.07000. Product Language: 2057. Manufacturer: McAfee, Inc.. Reconfiguration success or error status: 1603.

MSI (c) (D0:3C) [10:52:38:507]: Grabbed execution mutex.

MSI (c) (D0:3C) [10:52:38:507]: Cleaning up uninstalled install packages, if any exist

MSI (c) (D0:3C) [10:52:38:507]: MainEngineThread is returning 1603

=== Verbose logging stopped: 02/03/2016  10:52:38 ===

The following error is returned via patch7.msp installer file when run manually.

'This installation cannot continue because an incompatible version of the Mcafee Agent is installed.  Mcafee VirusScan Enterprise Setup will now exit.  For more information, please contact your Administrator'


Tested on 4 different machines, Windows 2008 R2, 2012R2, Windows 7 and Windows 8.1 all return the same error when using Mcafee Agent version 5.0.2.132.

---

In the past I have always been able to perform testing with the latest VSE versions without the requirement for checking in the software via EPO (management and reporting versions are checked in)

How to replicate;


Download the latest Patch info via EPO directly;

Menu > Software Manager
Mcafee Virus Scan Enterprise 8.8

Locate update within list;   Patch 7 - Package - Neutral - 8.8.0.7
Select Download and you will be provided with package VSE880P7.zip

Extract this on any Windows machine running Agent 5.0.2.132

Run the setup.exe or patch7.msp

Error returned claiming Agent version is not supported

I will remove 5.0.2.132 from the machine shortly and attempt an install with only 4.8 agent version installed.  I will update with my findings shortly.

Re: VSE Patch 7 and HIPS Patch 7 out

Remove the agent completely (5.0.2.132) and the installer runs without issue.  

C:\Program Files\McAfee\Agent\x86>FrmInst.exe /forceuninstall

Apply/Run patch7.msp

Patch 7 applies to the target machine correctly


Looks like Intel/Mcafee have created a new Patch that has no support for their latest Mcafee Agent.  Interesting.

Highlighted

Re: VSE Patch 7 and HIPS Patch 7 out

Confirmed as the Patch7 installer attempts to start the old service names for the Mcafee Agent.   This causes the MSI installer to cause you to 'ignore' the error presented so the Patch7 install can complete.   Reinstalling the Agent to 5.0.132 after the Patch 7 install has been run and errors ignored functions as desired.

Machine now displays in EPO as below

Installed Products - McAfee Agent 5.0.2.132, VirusScan Enterprise 8.8.0.1528

Basically Patch 7 installation packages are broken when used in conjunction Mcafee Agent 5.0.132. Well done on making a complete balls up of that.

PhilR
Level 12
Report Inappropriate Content
Message 27 of 42

Re: VSE Patch 7 and HIPS Patch 7 out

See the 5.0.2 Agent Hotfix release notes:

https://kc.mcafee.com/corporate/index?page=content&id=PD26386

Cheers,

Phil

Re: VSE Patch 7 and HIPS Patch 7 out

Wont fix the issue, the latest Agent has the same service names as 5.0.2.132 which is what causes the Patch7 installer to fail or hang installation.

It fails because the Patch7 installer is attempting to verify service names of the Agent version below 4.8 during the install process.

Service names of 5.0+ Agent

McAfeeFramework - McAfee Agent Backwards Compatibility Service '"C:\Program Files\McAfee\Agent\x86\macompatsvc.exe"

macmnsvc - McAfee Agent Common Services - "C:\Program Files\McAfee\Agent\macmnsvc.exe"

masvc - McAfee Agent Service - "C:\Program Files\McAfee\Agent\masvc.exe"

Sorry but even attempting a deployment via the EPO with a client task to push the evaluation version 8.8 (Patch7) fails immediately with the same error when the agent version is not 4.8.

Needs fixing, until then its not getting deployed at all.

McAfee Employee wwarren
McAfee Employee
Report Inappropriate Content
Message 29 of 42

Re: VSE Patch 7 and HIPS Patch 7 out

Patch 7 won't install on MA 5.0.2.132 because it is _not a supported agent_ for use with Patch 7.  Please review the Patch 7 release notes.

William W. Warren | S.I.R.R. | Customer Success Group | McAfee

Re: VSE Patch 7 and HIPS Patch 7 out

I´m having some kind of weird troubles in my environment. My machines have Mcafee agent version 5.0.2.188. After the upgrade of VSE to version 8.8.1528 patch 7, I had to disable the policy to allow explorer.exe execution, and more, some machines became very slow, specially when using web browsers like firefox or chrome. Even when I try to reboot or shutdown the machine, the process take to long to complete. Some others machine the patch 7 doesn´t install no matter how hard I try to do.

I´m thinking in performe a downgrade to vse 8.8.1445 P6. Is there a way to do that?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community