Here's a tweaky one.
On machines in the environment (test and production) we can duplicate the issue whereby install of HIPS8 Repost 1 (patch 1) is installed over HIPS 7.
Due to previous issue with this which caused disappearing devices on the uninstall of HIPS 7 (on XP, NDIS5) we disabled HIPS 7 product integrity checking per support in policy.
Even with this setting, machines that receive HIPS8 P1 after a reboot cannot access certain sites and will corrupt PDFs and XLS files when opened - but only on VPN. If we uninstall HIPS 8, same game. Have to restore or reimage. We have tried it with alternative VPN clients and get the same result. Very odd.
The only file that seems to be in play from pre to post reboot is mfenlfk .inf or .sys. I'm not sure what this file actually does.
My computer has had the HIPS 8 with patch 1 longer than any machine. It rendered PDFs fine until recently. Maybe a content release?
One more little nugget: I disabled and reenabled VirusScan on-access scan and access protection, and mine started working (no blocks in any logs, didn't work for anyone else with the issue. Tweaky.)
Just to close the loop, this was caused by a Citrix DNE driver interfering with HIPS 7 uninstall (part of the HIPS 8 deployment process). Beware the DNE . No known automated workaround...if the DNE driver is removed first, no issue.