• Enable full IPS and FW logging (All) and reproduce the issue.
• Do it from within the ePolicy Orchestrator (ePO) console, using the Host Intrusion Prevention General policy or locally. See KB51517 for detailed information.
  NOTE: Set the debug_enabled registry key for complete verbose logging.

To determine if any IPS security events are being triggered, reproduce the issue:

1. See KB54473 and search in HipShield.log for VIOLATION, examining any event violation details.
2. If a new signature is blocking the activity due to an <Event> trigger:
   1. Right-click the event as displayed from ePO and create an exception.
   2. Make exceptions as granular as possible by using the advanced parameters available for the event.
       
3. If there are limited advanced parameters for the event:
   1. If there is a CVE referenced in the IPS signature description and it indicates that a security update patch is available, apply and disable the signature if required.

If the issue began to occur after a Host IPS Security Content update:

1. See McAfee Knowledge Base article KB53092 and test with a content remediation signature package.

If the issue is not related to an IPS signature event trigger or a Host IPS Security Content update:

1. Disable all Host Intrusion Prevention modules (IPS, NIPS, AB, and FW). Retest and determine whether the issue occurs.
2. Disable IPS and stop the Host Intrusion Prevention agent service. Then retest and determine whether the issue occurs.
3. If the issue did not occur, see article KB66899. Make sure that you have enabled the option to allow unsupported protocols. (Even if FW is disabled, traffic can still be dropped because Host Intrusion Prevention is active.) Retest with this option set.
4. If it does not resolve the issue, uninstall the McAfee NDIS Intermediate Filter Miniport adapter, and retest to verify if the issue occurs. 

If issue occurs with only IPS module enabled, and no <Event> violations occurred in HipShield.log

1. Identify the executables associated with the application.
2. Exclude the executables for protection from the Host IPS Application Protection List.
3. Repeat test for application functionality. Note the results.
4. Reinclude the executables for protection from the Host IPS Application Protection List.
5. Isolate the IPS engine that might be causing the issue. For details, see KB54960
6. Identify the IPS engine that causes the issue.
7. Disable Signature 432. 
8. Continue to Gathering additional data.

Gathering additional data
If a running third-party process terminates with an exception or memory reference error when Host Intrusion Prevention IPS is enabled, do the following:

1. Make sure that full Host Intrusion Prevention logging is enabled during all data collection.
2. Install the Microsoft Debug Diagnostic Tool on the client. See: http://www.microsoft.com/downloadS/details.aspx?FamilyID=28bd5941-c458-46f1-b24d-f60151d875a3&displaylang=en
3. Configure the Debug Diagnostic Tool to monitor the terminating processes:
   1. Click Add Rule and then click Next.
   2. For the rule type, select Crash, and then click Next.
   3. Select A specific process, highlight the running process that you need to monitor, and click Next.
   4. Under Advanced Configuration, select None for Action type for unconfigured first chance exceptions and then click Next.
   5. Select a rule name and dump location.
   6. Activate the rule and click Finish.
      NOTE: The Debug Diagnostic tool now creates user mode process dumps for the processes associated with the third-party application when the process termination occurs.
       
4. Obtain another userdump for the McAfee FireSvc.exe process. Do this using Debug Diagnostics:
   1. Open the Debug Diagnostic Tool user interface.
   2. Click the Processes tab.
   3. Right-click on FireSvc.exe.
   4. Select Create Full Userdump to create a process dump.
       
5. Run the McAfee WebMER information tool on the client and collect system information and logs. For detailed information about the WebMer tool, see KB59385.
6. Open a support ticket with the third-party vendor for analysis of their process dumps. The vendor can add advanced information about why their process is impaired.
7. Send all user dumps and Host Intrusion Prevention WebMER results to Technical Support. Include the vendor analysis.
   NOTE: If the application is an IExplore.exe or Outlook.exe plug-in, obtain user mode process dumps for each of these processes.

If a running third-party process stops responding or generates high sustained CPU at some point during start or after start when Host Intrusion Prevention IPS is enabled, do the following:

1. Make sure that full Host Intrusion Prevention logging is enabled during all data collection.
2. Install the Microsoft Debug Diagnostic Tool on the client. See: http://www.microsoft.com/downloadS/details.aspx?FamilyID=28bd5941-c458-46f1-b24d-f60151d875a3&displaylang=en
3. On the client, enable a CrashOnCtrlScrl keyboard dump configuration.
4. Follow the instructions for PS/2 keyboard. See: http://support.microsoft.com/kb/Q244139
5. Restart the client to reproduce to process issue.
6. While the process stops responding, generate a userdump using the Debug Diagnostics Tool.
   1. Open the Debug Diagnostic Tool user interface.
   2. Click the Processes tab.
   3. Right-click on the process that has stopped responding.
   4. Select Create Full Userdump to create a process dump.
       
7. Repeat the process to obtain a userdump for the FireSvc.exe process.
8. While the process is still unresponsive, generate a full memory dump of the system using the keyboard.
9. After the dump completes, restart the client in safe mode to disable the Host Intrusion Prevention service.
10. Restart the computer again to save the memory dump file that was generated. A full kernel dump gets listed as memory.dmp in the root drive.
    NOTE: Compress the memory dump before uploading to McAfee. 
     
11. Run the McAfee WebMER information tool on the client and collect system information and logs. For detailed information about the WebMer tool, see KB59385.
12. Open a support ticket with the third-party vendor for analysis of their process dumps. The vendor can add advanced information about why their process is impaired.
13. Send all user dumps and Host Intrusion Prevention WebMer results to Technical Support, with the vendor analysis.

If the entire client computer stops responding during or after startup and Debug Diagnostics does not generate process dumps, do the following:

1. On the client, enable a CrashOnCtrlScrl keyboard dump configuration.
2. Follow the instructions for PS/2 keyboard. See: http://support.microsoft.com/kb/Q244139
3. Restart the client and generate a kernel dump when the client stops responding.
4. After the dump completes, restart the client in Safe Mode to disable the Host Intrusion Prevention service.
5. Restart the computer again to save the memory dump file that was generated. A full kernel dump is seen as memory.dmp in the root drive.
   NOTE: Compress the memory dump before uploading to McAfee.
    
6. Run the McAfee WebMER information tool on the client and collect system information and logs. For detailed information about the WebMer tool, see KB59385.
7. Open a support ticket with the third-party vendor for analysis of their process dumps. The vendor can add advanced information about why their process is impaired.
8. Send all dump and Host Intrusion Prevention WebMer results to Technical Support, with the vendor analysis.