McAfee Agent 5.0.5.739 Application Error on shutdown

[benjaminmh]

Just installed MA 5.0.5.739 on two W10 machines (10.0.14393) to test, and on both machines, when initiating a shutdown, I get the message:

McAfee Agent Updater: UpdaterUI.exe - Application Error

The instruction at <XXXX> referenced memory at <XXXX>. The memory could not be read.

Click on OK to terminate the program.

This holds up the shutdown process until you click OK.

Anyone seeing anything similar?

[tao]

Are you running DLP?  If so, not the same error - worth looking at: McAfee Corporate KB - Memory could not be written (Data Loss Prevention Endpoint Clipboard and Print...

[benjaminmh]

No DLP here - Only Drive Encryption

[g33k2303]

I am having the same issue here. Opened a support ticket with McAfee.
My current deployment:

McAfee Agent: 5.0.5.739

VSE: 8.8 Patch 9 (8.8.0.1804)

HIPS: 8.0 Patch 9 (8.0.0.4228)

SAE: 3.5 Patch 5 (3.5.0.1467)

DAT: 8538

ENG: 5900

OS: Win10 1703 - latest Cumulative Update.

As soon as I have anything new, I will post it in here.

Greetings,
Alex.

[g33k2303]

So apparently, this issue only appears when you have Windows 10 installed. I have verified this on Windows 7 and Windows 8.1 / Server 2008R2 and Server 2012R2.

Provided the technician with the requested information and I am currently working on McAfee Corporate KB - How to create a memory dump for analysis by Technical Support KB56023

Once this is done, I am awaiting further response from them.

I will keep you posted!

[benjaminmh]

McAfee has discovered an issue with the McAfee Agent 5.0.5 Hotfix 1188538. Until this issue can be resolved, the hotfix has been removed from the McAfee Downloads site. 
 
 Issue Details:
 After you install McAfee Agent Hotfix 1188538 (5.0.5.739), users see the following error when they attempt to log out of Windows: The instruction at 0x referenced memory at 0x. The memory could not be read.
 
 The end user must click OK to close the error and complete the log out.
 
 For additional information and updates, refer to KB89397: 
 https://kc.mcafee.com/corporate/index?page=content&id=KB89397

Well, I guess this settles that for now...

[g33k2303]

Coming back with the results from the support:

Good afternoon

I have investigated this with our engineering team yesterday and we have found that this is a memory heap allocation issue with this particular process and in light of this engineering has pulled this hotfix.

We strongly urge you to downgrade to the initial 505 version.

Regarding this case, I can escalate it to our SEO team and you can be notified by them once a new hotfix is available, but this will also be communicated via our SNS services.

The choice is up to you how you want to proceed.

Kind regards

So, as you said, this concludes the issue we both had

I did a rollback to the RTW version of 5.0.5 in order to get rid of that issue.

[Unblack]

We get the suggestion to downgrade to version 5.0.4.283.

But how can i do that? What is the correct command in the ePo Task?

[g33k2303]

Well, you normally just make an Agent Deployment and chose the option to "force installation over existing version".

Make sure that you have the 5.0.4.x Agent in your repository.

The desired Agent should then replace the 5.0.5 Agent on the system once deployed with "force installation" switch.

[Pmaquoi]

If you are using ENS product in your environment i would suggest to go back to version 5.0.5.680 instead of 5.0.4

P.Maquoi