1 2 Previous Next 18 Replies Latest reply on Sep 17, 2012 12:33 PM by SafeBoot

    EpePC has been corrupted (error 92h)

    kink80

      I see discussions related to the EpePC has been corrupted (error 92h) error on EEM Managed machines but has anyone seen this on ePO managed machines? I have a machine displaying this error that is running EEPC Software 6.1.0.248, EEPC Agent 1.1.0.248, McAfee Agent 4.5.0.1810, and Windows XP SP3. This machine is also at a remote site across the country. Is there any hope of recovery being done remotely?  Thanks in advance.

        • 1. Re: EpePC has been corrupted (error 92h)

          sure - you just need to use EETech standalone to emergency boot the machine, or use either version of EETech to decrypt it.

          • 2. Re: EpePC has been corrupted (error 92h)
            kink80

            After the E-boot I though the machine had to contact the ePO server to rebuild the PBFS. I do have the ports open on the ePO server to allow offsite machines to report in but I am pretty sure they will not download software from the ePO server. Does that seem to be correct?

            • 3. Re: EpePC has been corrupted (error 92h)

              I can't advise you on your network, but if your endpoint can't talk to EPO, then no, it's not going to rebuild EEPC.

              • 4. Re: EpePC has been corrupted (error 92h)
                kink80

                The machine can report into ePO just fine so would that signal that the PBFS rebuild would be successful as well?

                • 5. Re: EpePC has been corrupted (error 92h)

                  there are too many conditions - did you ever use EEGo from this site to check connectivity? That would tell you if it's possible.

                  • 6. Re: EpePC has been corrupted (error 92h)
                    cpromen

                    I am in the middle of an upgrade of our entire organization and I have 10 machines with this error at one of our remote sites. There are no real similarities (the make. model, disk mode, bios version, etc.vary).  The only similarity is that they are all at this one location.  I have deployed this to over 500 machines and so far these are the only 10 that have crashed and received this error 92h error.  I deployed to 38 at this one site and confirmed some upgraded without a problem.

                     

                    Nothing seems to fix the problem (Emerg. Boot, Remove EE and Fix MBR, etc.).  We are upgrading clients from EEPC 5.2.10 to 6.1.3 with the hotfix.  We have ePO 4.6 patch 1 and the clients are running McAfee Agent 4.6.  I have  ticket in with support, but nothing yet....I was hoping to access the drive with the EETECH tools to get the data off or view some logs,  but I can't see it even after authenticating and authorizing with the file.

                     

                    Anyone else seen this issue?  Any suggestions? 

                    • 7. Re: EpePC has been corrupted (error 92h)

                      If you have 92H, it means that the mbr code can't find the pre-boot OS where it expects - usually it's because some bad program deleted or moved the file, a third party defrag tool which does not follow unmovable file rules, or a repartitioning tool etc.

                       

                      something external to EEPC.

                       

                      You can't mount a drive in this state as EETech does not know what is and is not encrypted - all you can do is force decrypt it.

                       

                      So, I would look for some tool/process which moves files illegally.

                      • 8. Re: EpePC has been corrupted (error 92h)
                        cpromen

                        Thanks Simon.

                         

                        One of my co-workers worked with you through one of these blogs to get theWINPE environment and EETECH working for us.  It works on a 6.1.3encrypted drive in the since that I can boot up a known good encrypted drive, authenticate,authorize and see the contents of the encrypted drive to remove the data. With the drives that have received this 92h error I cannot.  My onlyoption is to format when I click on the drive after authenticating and authorizing.

                         

                        I saw mention in a post from you back in April about a TDSS rootkit causingissues like this(https://community.mcafee.com/thread/44889?start=0&tstart=0).  Haveyou seen that a lot? 

                        • 9. Re: EpePC has been corrupted (error 92h)

                          TDSS causes a slightly different error - you get "EEPC is not installed" after a pre-boot login.

                           

                          You can't see the contents of the drive in a 92H state, because EETech doesnt know what is and is not encrypted - you should still be able to test the key (using the workspace) and then force decrypt it though (via the partiton information). Then replace the MBR with a standard one and you'll be working again.

                          1 2 Previous Next