VSE 8.8. 6807 DAT problem - urgent!

[karnold002]

EJMast - that is a HIPS block.  You will need to disable that rule.

[harris_s]

Just found out that the hotfix patch update is failing on my 2003 servers, no more info from log files. Going to try standalone install.

[bostjanc]

Well?

-Soo in my case, do I still need to push

* both fixes: Hotfix 793781, Hotfix 793640.

* Only one of them?

* Or noone?

-How can I check now if everything works fine, because

* I don't have a disabled icon of VSE OAS anymore,

* noone 0.0000 engine version machines,

* and noone tags of a machines which have been affected with 6807/6808

???

[harris_s]

Have tried installing both hotfixes in standalone mode on one of our 2003 servers as didn't work through ePO and get the following error, anyone got the same? Am logged in as administrator on domain. May have to uninstall VSE and reinstall to see if that works.

[twenden]

Had the same "unable to read registry" on one system yesterday. Tried to uninstall VSE 8.8 but got error 1716 windows installer could not be accessed. Booted into safe mode and re-registered the windows installer. Booted the system and tried the hotfix again and got sucess.

[harris_s]

Cheers for that twenden, I'm currently mopping up the rest of my servers with an uninstall of VSE task in ePO followed by install then update, seems to be doing the trick. Will give it a couple of days then remove the hotfix from the repository unless anymore hotfixes are released.

[mjmurra]

New technote up with a solution for an issue that might be seen when running the fix:

https://kc.mcafee.com/corporate/index?page=content&id=KB76048

Problem

The update task that invokes either of the Hotfix solutions (Hotfix 793781 or Hotfix 793640) described in KB76004 fails.

Cause

The task to run Hotfix 793781 or Hotfix 793640 may fail if the registry value below is missing:

• 32-bit systems: HKLM\Software\McAfee\AVEngine, AVDatVersion
• 64-bit systems:  HKLM\Software\Wow6432Node\McAfee\AVEngine, AVDatVersion

[nzmikewilson]

Hey all

We want to create a query for the dashboard to see how many systems have the HF applied.

The query is:

select ln.nodename as Hostname, pp.productversion as Version, pp.hotfix as Patch, ps.value as Hotfix from epoleafnode ln join epoproductproperties pp on ln.autoid = pp.parentid join epoproductsettings ps on pp.autoid = ps.parentid where ps.settingname = 'Fixes' and ps.value like '%793781%'

order by hostname

Does anyone know if its possible to create a query based on an SQL statement, such as this? Currently we can "view" queries in SQL language (select query in ePO , click Actions, view SQL) but not "create" , unless we log on to the DB directly..

Any help appreciated!

Cheers,
Mike

[mjmurra]

nzmikewilson wrote:
Does anyone know if its possible to create a query based on an SQL statement, such as this? Currently we can "view" queries in SQL language (select query in ePO , click Actions, view SQL) but not "create" , unless we log on to the DB directly..
Any help appreciated!
Cheers,
Mike

I believe the answer is no, for two reasons... Firstly, wouldn't McAfee support have suggested this in the technote rather than the SQL statement? Also, I've never been able to achieve it.

There's a tool in the ePO tool exchange though which might assist with this identification task though. https://community.mcafee.com/docs/DOC-4124 (Haven't tested it yet - although have checked it into my test box)

[nzmikewilson]

I was thinking I could export a query and modify the XML to adjust the SQL query and reimport it. Havent tested this. I'll check out the tool you mentioned.

Cheers