cancel
Showing results for 
Search instead for 
Did you mean: 

Master Repository Update failed Source Computers: McAfeeHttp and McAfeeHttp

Hi,

I get a problem with both Http and FTP update of master repository:

What could be the reason of this ? IT has worked well before, but since this weekend it is giving errors all the time.

Br,

Maarten van der Schrieck

0 Kudos
9 Replies
tao
Level 13

Re: Master Repository Update failed Source Computers: McAfeeHttp and McAfeeHttp

I have seen this error before "...site ftp.nai.com:21, error code 10054 (An existing connection was forcibly closed by the remote host.)" and it had something to do with either the firewall or gateway.  Also, double check EpoApSvr.log - it may provide some additional troubleshooting information.

0 Kudos

Re: Master Repository Update failed Source Computers: McAfeeHttp and McAfeeHttp

Very strange, when I look at the firewall I can see the traffic is blocked due to a Trojan at McAfee site. We have now excluded the IP from the McAfee server and now it is working.

0 Kudos
tao
Level 13

Re: Master Repository Update failed Source Computers: McAfeeHttp and McAfeeHttp

Old KB - same type of error-

DAT download blocked by SonicWall Gateway scanning Technical Articles ID:   KB58039 Last Modified:  7/27/2015

McAfee Corporate KB - DAT download blocked by SonicWall Gateway scanning   KB58039

and perhaps the same type of reason/cause-

Cause: The Gateway is triggering on the McAfee DAT .zip or .tar file because the ReadMe.txt file contains the EICAR anti-virus test string (www.eicar.com).

0 Kudos

Re: Master Repository Update failed Source Computers: McAfeeHttp and McAfeeHttp

Only difference is that it is now finding the following virus that is the reason for our Sonicwall to block the traffic: MalAgent.I_14172 (Trojan)

Putting the McAfee IP in the exclusion list of the antivirus gateway of the Sonicwall solves the problem.

0 Kudos
ercle
Level 7

Re: Master Repository Update failed Source Computers: McAfeeHttp and McAfeeHttp

We are getting a failure to Update the Master Repository as well!

It has been failing for a few weeks now.

Here is a snapshot of the EpoApSvr.log file

2016-12-20_13-29-25.jpg

As you can see, the first three files downloads and get verified successfully but the amupdate.dll file gets downloaded successfully but fails the file size verification.

The FTP site has this file at over 2GB but downloads successfully at 2KB?

The download then fails and the update stops!

As mentioned in the following KB article , we have tried to delete the "current" folder containing the amupdate.dll file and nothing changed.

The files are not even being properly downloaded to our ePO server.

Any help would be appreciated.

0 Kudos
tao
Level 13

Re: Master Repository Update failed Source Computers: McAfeeHttp and McAfeeHttp

0 Kudos

Re: Master Repository Update failed Source Computers: McAfeeHttp and McAfeeHttp

Read this KB article:

https://kc.mcafee.com/corporate/index?page=content&id=KB58039

At our site it was not the Eicar virus, but the MalAgent.I_14172 (Trojan)

0 Kudos

Re: Master Repository Update failed Source Computers: McAfeeHttp and McAfeeHttp

Just check your firewall what happens with the traffic from your EPO server or your client. to the server from McAfee. THis was for us the way to figure out what was wrong.

0 Kudos
ercle
Level 7

Re: Master Repository Update failed Source Computers: McAfeeHttp and McAfeeHttp

You were all correct!

Tao, I could not manually download the DLLs or EXEs from the server. Firewall blocked message!

Maarten, as you can see above, our environment was given a modified firewall rule set that was blocking the downloads of DLLs, EXEs and executable files.

Rule set was modified and all is fine now.

Thank you all!

0 Kudos