3 Replies Latest reply on Feb 24, 2009 4:09 PM by obletron3000

    HIPS 7.x blocking DLL registration via msiexec

      I've been racking my brain on this one for the past 3 days, trying everything I can think of to get this to stop happening to no avail, so thought I'd post here to see if anyone has any insight into the issue I'm running into.

      I have a piece of software (FAS 100 Asset Accounting) that is an installshield wrapped msi. Toward the end of the installation sequence, the installation process hangs, specifically when registering "modules" aka dlls. Much troubleshooting has revealed that disabling Host IPS on any given client machine allows for the install to complete successfully, though the installation has to be restarted for that to happen (once the installation stalls, there's no reviving it). I turned on verbose logging for msiexec and here's an example of exactly where/what HIPS is intruding upon:

      MSI (s) (40:A4) [15:05:01:309]: Executing op: RegSelfReg(File=BPLIC.dll,FileID=BPLIC.dll)
      MSI (s) (40:A4) [15:05:01:559]: Executing op: RegSelfReg(File=BPCSP32.dll,FileID=BPCSP32.dll)

      Now I would expect something to be logged HipShield.log related to this, but I get nothing.

      I would go to the obvious source for assistance (the software vendor, Sage) but here's the deal, we released Patch 2 for Hips 7.0 back a couple weeks ago. Prior to patch 2 being deployed, this software installed perfectly every time. I went ahead and downloaded patch 3.05 and applied it on one of my lab machines but the behavior is still the same.

      Anyone out there have any insight on what might be going on here? I will probably log an official ticket with McAfee but find that to be so cumbersome just to get to someone who doesn't operate off of a script on a computer screen...jumping the tiers is PIA.

      Thanks for any assistance!
      Chris M.
        • 1. I've seen this too
          Did you ever figure out how to get around this? I've seen this when uninstalling/installing an application called ArcGIS (specifically when upgrading from version 9.2 to 9.3). The uninstall always locks up when unregistering DLLs (and installing the new version locks up when registering DLLs). If you re-run the uninstall/install, the lock ups don't happen on the same files (which makes me think that it's not purposely being blocked by the IPS).

          If you disable the host IPS on the machine, everything works like it's supposed to with no lock ups.
          • 2. RE: I've seen this too
            Yes. We had to exclude the Microsoft Installer application from under the following location:


            My personal option is the problem is actually a flaw in HIPS as nothing is logged in regards to this blocking behavior that's been seen on more than one of our msi-based applications. Excluding the msi engine from protection cured the problem in our environment.

            Let me know if that makes sense or not. happy
            • 3. Thanks!
              I won't be able to try this until Thursday, but thanks! I'm pretty sure our HIPS admin will know how to add the exclusion based on the picture.