McAfee Agent fails to update or deploy products due to an untrusted or unsigned DLL

Technical Articles ID: KB93263
Last Modified: 2023-08-14 06:38:26 Etc/GMT

Environment

McAfee Agent (MA) 5.7.x, 5.6.x

Problem

When MA runs a scheduled task that calls on the McScript_InUse.exe process, the task fails.

The masvc_computer_name.log records entries similar to the ones below:

NOTE: Default log location: C:\ProgramData\McAfee\Agent\logs\

masvc(3068.3148) Updater.Info: Script Event msg iEventId "0" iSeverity "0" iProductId "EPOAGENT3000" iLocale "0409" iUpdateType "N/A" iUpdateState "4" iUpdateError "26" iNewVersion "N/A" iDateTime "N/A" iCustomMessage ""
masvc(3068.3148) Updater.Debug: Script progress muecProgressEvent "4" Message "Update process failed"
masvc(3068.3148) Updater.Debug: Task summary xml : <Status><Code>-1</Code><TaskName>update</TaskName><Detail>Deployment/Update task failed, reason "Unable to find valid repository".</Detail><FailureReason></FailureReason></Status>.
masvc(3068.3148) scheduler.Info: The task update has failed

The McScript.log records entries similar to the following:

I #7924 network URL(https://myePO.lab2.local:443/Software/SiteStat.xml?hash={0d884446-e180-11ea-081e-2be48f0084e6}) request, failed with curl error 6, Response 0, Connect code 0,

I #7924 curl text 41 Could not resolve host: myePO.lab2.local

E #7924 downloader Downloading file from https://myePO.lab2.local:443/Software/SiteStat.xml?hash={0d884446-e180-11ea-081e-2be48f0084e6} to C:\WINDOWS\TEMP\SiteStat.xml failed.

I #7924 network URL(http://update.nai.com:80/Products/CommonUpdater/SiteStat.xml?hash={0eda3fb6-e180-11ea-19af-2be48f0084e6}) request, failed with curl error 6, Response 0, Connect code 0,

I #7924 curl text 39 Could not resolve host: update.nai.com

E #7924 downloader Downloading file from http://update.nai.com:80/Products/CommonUpdater/SiteStat.xml?hash={0eda3fb6-e180-11ea-19af-2be48f0084e6} to C:\WINDOWS\TEMP\SiteStat.xml failed

Cause

An untrusted or unsigned DLL is injecting into the Layered Service Provider (LSP) stack, and Arbitrary Access Control (AAC) rules are blocking the injector from hooking into McScript_InUse.

If you can download or view the sitestat.xml file from the affected system, look to see if there's an AAC block. Look for an injection in the mfemactl.log. Review the log for the duration of the update or that the deployment task failed. The default location is C:\ProgramData\McAfee\Agent\logs\mfemactl.log.

Example

mfemactl(4704.5040) mfemactl.Info: The process <C:\PROGRAM FILES\MCAFEE\AGENT\X86\MCSCRIPT_INUSE.EXE>(7136) was blocked from accessing('CREATE' (1)) <AAC_OBJECT_SECTION:C:\WINDOWS\SYSWOW64\ASPROXY.DLL> via the rule <Sanitize selected MA Processes>
mfemactl(4704.5040) mfemactl.Info: The process <C:\PROGRAM FILES\MCAFEE\AGENT\X86\MCSCRIPT_INUSE.EXE>(7136) was blocked from accessing('CREATE' (1)) <AAC_OBJECT_SECTION:C:\WINDOWS\SYSWOW64\ASPROXY.DLL> via the rule <Sanitize selected MA Processes>

The above indicates that both of the following have occurred:

An untrusted or unsigned DLL is injecting into the LSP stack.
AAC rules are blocking the injector from hooking into McScript_InUse.

Solution

Identify the injector and set up a trust:

Run the latest sysprep tool to detect and trust the possible injectors. For more information about this tool, see KB89860 - How to use the SysPrep Utility (MFESysPrep).
Update the software that's injecting to a later version.
If ENS is installed, add the DLL certificate to the ENS common policy in ePO.
On the client, find the DLL causing the injection from the mfemactl.log.
1. Navigate to the location where the DLL is located.
2. Right-click the DLL and Click Properties.
3. Click the Digital Signatures tab.
4. Select the certificate and click Details.
5. Click View Certificate.
6. Click the Details tab, and click the option Copy to File.
7. On the next screen, click Next, and Next again.
8. Choose a path and a name for the exported certificate.
9. Click Next.
  
  NOTE: Leave the default file extension it assigns.
  
  The certificate is exported.
10. If Endpoint Security (ENS) is installed on the client, you must add the newly created certificate to the ENS common policy in ePO.

Other applicable resources:

KB88085 - Third-party DLL injectors, code detours, and hooking

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

McAfee Agent fails to update or deploy products due to an untrusted or unsigned DLL

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

McAfee Agent fails to update or deploy products due to an untrusted or unsigned DLL

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title