cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
harris_s
Level 9
Report Inappropriate Content
Message 111 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

Yes, it's the only way to be sure I'm afraid.

bretzeli
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 112 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

Q: You guys all pushing the HF to all 8.8 clients?

Yes it says in the KB:

McAfee has released VSE 8.8 Hotfix 793640 to remediate this issue. THIS IS A MANDATORY HOTFIX.

1) And yes DO push the HOTFIX to all clients and Servers you have. Make a DEPLOY/Update Task at the ROOT of your system Structure

2) And yes IF you can reboot is always a good option

3) And yes you CITRIX adminds reboot your Farms and stick with Fat client and once again your solution is not saving money

qwerty
Level 7
Report Inappropriate Content
Message 113 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

This problem can resolved by uninstalling and reinstalling VSE.  I have confirmed this through testing and with McAfee Support.

To solve this I first updated all clients to pull updates from McAfee's Repository.

I then queried all nodes for engine version 0.0

I then pushed the VSE 8.8p1 install file to all nodes with engine version 0.0.

This can be accomplished using Group Policy, batch files, login scripts, etc.

I then pushed and executed the following batch file using similar methods.

msiexec /x {CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF} REMOVE=ALL /q

"c:\VSE880LMLRP1\setupvse.exe" /q /l*v "C:\Windows\Temp\McAfeeLogs\McAfeeVSE_Install.log"

This will uninstall then reinstall VSE 8.8p1and not require a reboot.

datalore
Level 7
Report Inappropriate Content
Message 114 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

I am performing the updates manually on my servers first, following the standalone instructions.

I am just having a problem with a Wondows 2008 R2 64-bit server - when I go to install the hotfix, I receive a "Unable to find any qualifying product(s)" message.

Anyone else suffering from a similar error?

brentil
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 115 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

I noticed on a couple 2003 Servers that when I ran the update manually it would tell me the product was already installed.  So I ran it with a /F and forced installation on those machines.  Those with 2003 machines failing the EICAR test might want to try this.

toddunger
Level 7
Report Inappropriate Content
Message 116 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

Thanks for the idea.  Unfortunately, didn't work.  Uninstall reinstall (reboot in between or not) doesn't work consistently.  Deployment from ePO or manual install doesn't work consistently.  They all report the right information, just don't do anything to EICAR.

itsectech
Level 7
Report Inappropriate Content
Message 117 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

We had ~100 systems effected by this issue. I have corrected many of them with the following process:

  1. Checked in Hotfix
  2. Wake Target Agents
  3. Pushed update to several affected systems at a time
  4. Wake Agent / Force policy update
  5. After update is complete, reboot system
  6. Wake Agent / Force policy update
  7. Check DAT and Engine versions
  8. If compliant, drop EICAR file on the system

Every one of the systems I have done this for so far have passed the EICAR test.

Re: VSE 8.8. 6807 DAT problem - urgent!

When applying the hotfix, is anyone else getting the below from Access Protection?

[quote]

A false positive event has been triggered.

Signature ID: 1002

Signature name: Windows Agent Shielding - Registry Access Attack time: 8/21/2012 9:14:30 AM

User: NT AUTHORITY\SYSTEM

Process: C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MCAFEE\COMMON FRAMEWORK\CURRENT\VIRUSCAN8800\HOTFIX\793640\0000\VSE88HF793640.EXE

[/quote}

TIA!

brentil
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 119 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

Is that a HIPS alert?  If so as long as it's not blocking the installation I would ignore it for now.

greatscott
Level 12
Report Inappropriate Content
Message 120 of 230

Re: VSE 8.8. 6807 DAT problem - urgent!

yes thats a HIPS Signature, High severity (1002 - Windows Agent Shielding-Registry Access). It could likely be blocking something so I wouldnt ignore it. I say that simply based on its severity level.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community